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THE GRAND JURY CHARGES THAT: 

GENERAL ALLEGATIONS 

At all times relevant to this Superseding Indictment: 

1. KIM DOTCOM, MEGAUPLOAD LIMITED, VESTOR LIMITED, FINN 
BATATO, JULIUS BENCKO, SVEN ECHTERNACH, MATHIAS ORTMANN, ANDRUS 
NOMM, and BRAM VAN DER KOLK, the defendants, and others known and unknown to the 
Grand Jury, were members of the "Mega Conspiracy," a worldwide criminal organization whose 
members engaged in criminal copyright infringement and money laundering on a massive scale 
with estimated harm to copyright holders well in excess of $500,000,000 and reported income in 
excess of $175,000,000. 

2. Megaupload.com is a commercial website and service operated by the Mega 
Conspiracy that reproduces and distributes copies of popular copyrighted content over the 
Internet without authorization. Since at least September 2005, Megaupload.com has been used 
by the defendants and other members and associates of the Mega Conspiracy to willfully 
reproduce and distribute many millions of infringing copies of copyrighted works, including 
motion pictures, television programs, musical recordings, electronic books, images, video games, 
and other computer software. Over the more than five years of its existence, the Mega 
Conspiracy has aggressively expanded its operations into a large number of related Internet 
businesses, which are connected directly to, or at least financially dependent upon, the criminal 
conduct associated with Megaupload.com . 

3. Megaupload.com was at one point in its history estimated to be the 13th most 
frequently visited website on the entire Internet. The site claims to have had more than one 
billion visitors in its history, more than 180,000,000 registered users to date, an average of 
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50 million daily visits, and to account for approximately four percent of the total traffic on 
the Internet. As of January 19, 2012, there were actually approximately 66.6 million users 
registered in the Mega Conspiracy's internal database records; of these registered users, the 
records further show that, at most, only 5.86 million users had ever uploaded a single file to 
either Megaupload.com or Megavideo.com . 

4. Megaupload.com ' s income comes primarily from two sources: premium 
subscriptions and online advertising. Premium subscriptions for Megaupload.com have been 
available for online purchase for as little as a few dollars per day or as much as approximately 
$260 for a lifetime. In exchange for payment, the Mega Conspiracy provides the fast 
reproduction and distribution of infringing copies of copyrighted works from its computer 
servers located around the world. Premium users of the site, a small percentage of the overall 
user base, are able to download and upload files with few, if any, limitations. Subscription fees 
collected during the existence of the Mega Conspiracy from premium users are estimated to be 
more than $150 million. Online advertising on Megaupload.com and its associated websites, 
which is heavily dependent on the popularity of copyright infringing content to attract website 
visits, has further obtained more than $25 million for the Mega Conspiracy. 

5 . The financial proceeds of Megaupload.com have been primarily directed to four 
sources. First, the Conspiracy has directed the bulk of its revenues to the defendants, corporate 
entities they control, other co-conspirators, and employees for their commercial advantage and 
private financial gain. Second, the Mega Conspiracy has spent millions of dollars developing 
and promoting Megaupload.com and complementary Internet sites and services, such as 
Megavideo.com , Megaclick.com, Megaporn.com , and a host of others (collectively the "Mega 
Sites"). Third, for much of its operation, the Mega Conspiracy has offered an "Uploader 
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Rewards" Program, which promised premium subscribers transfers of cash and other financial 
incentives to upload popular works, including copyrighted works, to computer servers under the 
Mega Conspiracy's direct control and for the Conspiracy's ultimate financial benefit. The more 
popular content that was present on Mega Conspiracy servers would increase the number of 
visitors and premium users that the Conspiracy could monetize. In total, the Mega Conspiracy 
directly paid uploaders millions of dollars through online payments. Fourth, the Mega 
Conspiracy spends millions of dollars per month on the infrastructure supporting their 
businesses, including the leasing of computers, hosting charges, and Internet bandwidth. In 
contrast to legitimate Internet distributors of copyrighted content, Megaupload.com does not 
make any significant payments to the copyright owners of the many thousands of works that are 
willfully reproduced and distributed on the Mega Sites each and every day. 

6. Any Internet user who goes to the Megaupload.com website can upload a 
computer file. Once that user has selected a file on their computer and clicks the "upload" 
button, Megaupload.com reproduces the file on at least one computer server it controls and 
provides the uploading user with a unique Uniform Resource Locator ("URL") link that allows 
anyone with the link to download the file. For example, a link distributed on December 3, 2006 
by defendant DOTCOM (www.megaupload.com/?d=BYl 5XE3 V) links to a musical recording 
by U.S. recording artist "50 Cent." A single click on the link accesses a Megaupload.com 
download page that allows any Internet user to download a copy of the file from a computer 
server that is controlled by the Mega Conspiracy. 

7. Megaupload.com advertises itself as a "cyberlocker," which is a private data 
storage provider. However, as part of the design of the service, the vast majority of 
Megaupload.com users do not have significant capabilities to store private content long-term. 
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Unregistered anonymous users (referred to as "Non-Members" by the Conspiracy) are allowed to 
upload and download content files, but any Non-Member-uploaded content that is not 
downloaded within 21 days is permanently deleted. Similarly, registered free users (or 
"Members") are allowed to upload and download content files, but each uploaded file must be 
downloaded every 90 days in order to remain on the system. Only premium users have a 
realistic chance of having any private long-term storage, since their files are not regularly deleted 
due to non-use. In contrast, when any type of user on Megaupload.com uploads a copy of a 
popular file that is repeatedly downloaded, including infringing copies of copyrighted works 
available for download, that file remains on Mega Conspiracy-controlled computers and is 
available for distribution by anyone who can locate an active link to the file. 

8. Furthermore, in order to mass distribute copies of the works on the systems it 
controls, the Mega Conspiracy has created a computer system architecture that keeps its most 
frequently downloaded files in memory (rather than in storage) on a number of dedicated high- 
end computer servers that are located at two facilities that belong to one of the leading broadband 
providers in the world. The vast majority of the files on these computers are infringing copies of 
copyrighted works, and the Mega Conspiracy has purposefully made their rapid and repeated 
distribution a primary focus of their infrastructure. 

9. Once a user clicks on a Megaupload.com download link, the user is generally 
brought to a download page for the file. The download page contains online advertisements 
provided by the Conspiracy, which means that every download on Megaupload.com provides a 
financial gain to the Conspiracy that is directly tied to the download. The more popular the 
content, such as copies of well-known copyrighted works, the more users that find their way to a 
Megaupload.com download page; the access of these additional users, in turn, makes the Mega 
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Conspiracy more money. Because approximately one percent of Megaupload.com users pay for 
their use of the systems, Mega Conspiracy's business strategy for advertising requires 
maximizing the number of online downloads (i.e., distributions of content), which is also 
inconsistent with the concept of private storage. 

10. In addition to displaying online advertisements, the download pages on 
Megaupload.com are designed to increase premium subscriptions. All non-premium users are 
encouraged to buy a premium subscription to decrease wait and download times, which can be at 
least an hour for popular content (and, for some periods of time, these users have been ineligible 
to download files over a certain size). As a result, non-premium users are repeatedly asked by 
the Conspiracy to pay for more and faster access to content on Megaupload.com . Users are also 
prompted to view videos uploaded to Megaupload.com directly on a proprietary player designed 
by the Conspiracy and offered through the Megavideo.com website and service. Users have also 
been asked if they want to generate a new link to the downloading file and import it to their own 
Megaupload.com accounts, which facilitates distribution that is again inconsistent with 
private storage. 

1 1 . The content available from Megaupload.com is not searchable on the website, 
which allows the Mega Conspiracy to conceal the scope of its infringement. Instead of hosting a 
search function on its own site, the Mega Conspiracy business model purposefully relies on 
thousands of third party "linking" sites, which contain user-generated postings of links created 
by Megaupload.com (as well as those created by other Mega Sites, including Megavideo.com 
and Megaporn.corn) . While the Conspiracy may not operate these third party sites, the Mega 
Conspiracy did provide financial incentives for premium users to post links on linking sites 
through the "Uploader Rewards" program, which ensured widespread distribution of 
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Megaupload.com links throughout the Internet and an inventory of popular content on the Mega 
Conspiracy's computer servers. These linking sites, which are usually well organized and easy 
to use, promote and direct users to Mega Conspiracy download pages that allow the reproduction 
and distribution of infringing copies of copyrighted works. 

12. Popular linking sites that contained Mega Conspiracy-generated links include: 
niniavideo.net, megaupload.net , megarelease.net , kino.to , alluc.org , Deliculasvonkis.com . 
seriesvonkis.com , surfthechannel.com , taringa.net , thepiratecitv.org . and mulinks.com . While 
several of these websites exclusively offer Megaupload.com links, all maintained an index of 
URL links to identified copies of copyrighted content that were stored on servers directly 
controlled by the Mega Conspiracy. 

13. The Mega Conspiracy closely monitors the traffic from linking sites to the Mega 
Sites and services. The Conspiracy is aware that linking sites generate a very high percentage of 
the millions of visits to its websites and services each week and provide the Conspiracy direct 
financial benefits through advertising revenue and opportunities for new premium subscriptions. 

14. Members of the Mega Conspiracy have knowingly interacted with users of 
linking sites and visited the sites (and associated online forums) themselves. Specifically, some 
of the defendants have instructed individual users how to locate links to infringing content on the 
Mega Sites (including recommending specific linking websites). Several of the defendants have 
also shared with each other comments from Mega Site users demonstrating that they have used 
or are attempting to use the Mega Sites to get infringing copies of copyrighted content. 

15. In contrast to the public who is required to significantly rely on third party 
indexes, members of the Conspiracy have full access to the listings of actual files that are stored 
on their servers (as well as the Megaupload.com - and Megavideo.com - and Megaporn.com - 
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generated links to those files). Conspirators have searched the internal database for their 
associates and themselves so that they may directly access copyright-infringing content on 
servers controlled by the Mega Conspiracy. 

1 6. Though the public-facing Megaupload.com website itself does not allow searches, 
it does list its "Top 100 files", which includes motion picture trailers and software trials that are 
freely available on the Internet. The Top 100 list, however, does not actually portray the most 
popular downloads on Megaupload.com, which makes the website appear more legitimate and 
hides the popular copyright-infringing content that drives its revenue. 

17. If a user uploads a video file to Megaupload.com . the user can utilize the provided 
URL link to redirect others to another Mega Conspiracy-controlled website, Megavideo.com . 
where they can view the file using a "Flash" video player. Alternatively, a user who hosts a 
personal or commercial website can embed the Megavideo.com player into their own website to 
display the video file (and provide advertising content from the Mega Conspiracy). 
Megavideo.com has been estimated to be as popular as the 52nd most frequently visited website 
on the entire Internet. 

18. A non-premium user is limited to watching 72 minutes of any given video on 
Megavideo.com at a time, which, since nearly all commercial motion pictures exceed that length, 
provides a significant incentive for users who are seeking infringing copies of motion pictures to 
pay the Mega Conspiracy a fee for premium access. Some premium users are, therefore, paying 
the Mega Conspiracy directly for access to infringing copies of copyrighted works. 

1 9. Before any video can be viewed on Megavideo.com. the user must view an 
advertisement. Originally, the Mega Conspiracy had contracted with companies such as 
adBrite, Inc., Google AdSense, and PartyGaming pic for advertising. Currently, the 
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Conspiracy's own advertising website, Megaclick.com , is used to set up advertising 
campaigns on all the Mega Sites. The high traffic volume on the Conspiracy websites allows 
the Conspiracy to charge advertisers up-front and at a higher rate than would be achieved by 
the percentage-per-click methodology used by other popular Internet advertising companies. 
The popularity of the infringing content on the Mega Sites has generated more than $25 million 
in online advertising revenues for the Conspiracy. 

20. Like Megaupload.com , Megavideo.com conceals many of the infringing copies of 
popular copyrighted videos that are available on and distributed by the site and the associated 
service. Megavideo.com does purport to provide both browse and search functions, but any 
user's search on Megavideo.com for a full length copyrighted video (which can be downloaded 
from a Mega Conspiracy-controlled server somewhere in the world) will not produce any results. 
Similarly, browsing the front page of Megavideo.com does not show any obviously infringing 
copies of any copyrighted works; instead, the page contains videos of news stories, user- 
generated videos, and general Internet videos in a manner substantially similar to Youtube.com . 
Browsing the most-viewed videos in the Entertainment category on Megavideo.com . 
however, has at times revealed a number of infringing copies of copyrighted works that are 
available from Mega Conspiracy-controlled servers and are amongst the most viewed materials 
being offered. 

21 . Members of the Conspiracy have publicly stated that they operate the Mega Sites 
in compliance with the notice and takedown provisions of the Digital Millennium Copyright 
Act ("DMCA"), codified at Title 17, United States Code, Section 512, despite the fact that they 
are violating its provisions. Internet providers gain a safe harbor under the DMCA from civil 
copyright infringement suits in the United States if they meet certain criteria. The members of 
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Mega Conspiracy do not meet these criteria 1 because they are willfully infringing copyrights 
themselves on these systems; have actual knowledge that the materials on their systems are 
infringing (or alternatively know facts or circumstances that would make infringing material 
apparent); receive a financial benefit directly attributable to copyright-infringing activity where 
the provider can control that activity; and have not removed, or disabled access to, known 
copyright infringing material from servers they control. 

22. Members of the Mega Conspiracy negotiated the use of an "Abuse Tool" with 
some major U.S. copyright holders to purportedly remove copyright-infringing material from 
Mega Conspiracy-controlled servers. The Abuse Tool allowed copyright holders to enter 
specific URL links to copyright infringing content of which they were aware, and they were 
told by the Conspiracy that the Mega Conspiracy's systems would then remove, or disable 
access to, the material from computer servers the Conspiracy controls. The Mega Conspiracy's 
Abuse Tool did not actually function as a DMCA compliance tool as the copyright owners were 
led to believe. 

23. When a file is being uploaded to Megaupload.com . the Conspiracy's automated 
system calculates a unique identifier for the file (called a "MD5 hash") that is generated using a 
mathematical algorithm. If, after the MD5 hash calculation, the system determines that the 
uploading file already exists on a server controlled by the Mega Conspiracy, Megaupload.com 
does not reproduce a second copy of the file on that server. Instead, the system provides a new 
and unique URL link to the new user that is pointed to the original file already present on the 

1 Furthermore, the safe harbor requires that an eligible provider have an agent designated with 
the U.S. Copyright Office to receive infringement notices; despite having millions of users in the 
United States since at least the beginning of the Conspiracy, the Conspiracy did not designate 
such an agent until October 15, 2009, years after Megaupload.com and many of its associated 
sites had been operating and the DMCA had gone into effect. 
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server. If there is more than one URL link to a file, then any attempt by the copyright holder to 
terminate access to the file using the Abuse Tool or other DMCA takedown request will fail 
because the additional access links will continue to be available. 

24. The infringing copy of the copyrighted work, therefore, remains on the 
Conspiracy's systems (and accessible to at least one member of the public) as long as a single 
link remains unknown to the copyright holder. The Conspiracy's internal reference database 
tracks the links that have been generated by the system, but duplicative links to infringing 
materials are neither disclosed to copyright holders, nor are they automatically deleted when a 
copyright holder either uses the Abuse Tool or makes a standard DMCA copyright infringement 
takedown request. During the course of the Conspiracy, the Mega Conspiracy has received 
many millions of requests (through the Abuse Tool and otherwise) to remove infringing copies 
of copyrighted works and yet the Conspiracy has, at best, only deleted the particular URL of 
which the copyright holder complained, and purposefully left the actual infringing copy of the 
copyrighted work on the Mega Conspiracy-controlled server and allowed access to the infringing 
work to continue. 

25 . In addition to copyrighted files, other types of illicit content have been uploaded 
onto the Megaupload.com servers, including pornography and terrorism propaganda videos. 
Members of the Conspiracy have indicated to each other that they can automatically identify and 
delete such materials on all of their servers by calculating MD5 hash values of known child 
pornography or other illicit content, searching the system for these values, and eliminating them; 
in fact, such files with matching hash values have been deleted from the Mega Conspiracy's 
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servers. 2 Members of the Mega Conspiracy have failed to implement a similar program to 
actually delete or terminate access to copyright infringing content. 

26. On or about June 24, 20 1 0, members of the Mega Conspiracy were informed, 
pursuant to a criminal search warrant from the U.S. District Court for the Eastern District of 
Virginia, that thirty-nine infringing copies of copyrighted motion pictures were present on their 
leased servers at Carpathia Hosting, a hosting company headquartered in the Eastern District of 
Virginia. A member of the Mega Conspiracy informed several of his co-conspirators at that time 
that he located the named files using internal searches of their systems. As of November 1 8, 
201 1, more than a year later, thirty-six of the thirty-nine infringing motion pictures were still 
being stored on the servers controlled by the Mega Conspiracy. 

27. At all times relevant to this Indictment, the defendants and other members of the 
Mega Conspiracy knew that they did not have license, permission, authorization, or other 
authority from owners of hundreds of thousands of copyrighted works to reproduce and 
distribute those works, including making them available over the Internet. Members of the Mega 
Conspiracy are aware of the way that their sites are actually used by others; have themselves 
used the systems to upload, as well as reproduce and distribute, infringing copies of copyrighted 
content; and are aware that they have financially benefitted directly from the infringement of 
copyrighted works that they are in a position to control. 

28. In addition to Megaupload.com , Megavideo.com . and Megaclick.com . the other 
websites created and domains owned by the Mega Conspiracy include: Megaworld.com : 
Megalive.com ; Megapix.com ; Megacar.com ; Megafund.com ; Megakev.com ; Megaking.com : 
Megahelp.com ; Megagogo.com : Megamovie.com ; Megaporn.com ; Megabackup.com : 

2 Internal records of the Mega Conspiracy suggest, as of January 19, 2012, however, that only 
221 unique actual files have been deleted in this manner. 
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Megapav.com ; Megabox.com ; and Megabest.com . Several of these additional sites have also 
hosted infringing copies of copyrighted works. The websites and services, as well as the 
domains themselves, have been facilitated and promoted by illicit proceeds from the operations 
of Megaupload.com , Megavideo.com , and Megaclick.com . 

29. In addition to MEGAUPLOAD LIMITED, VESTOR LIMITED, Megamedia 
Limited, Megavideo Limited, Megarotic Limited, Megapix Limited, Kingdom International 
Ventures Limited, Netplus International Limited LLC, Basemax International Limited, and 
Mindpoint International Limited LLC, the following companies and entities have facilitated and 
promoted the Mega Conspiracy's operations: Kimvestor Limited; Trendax Limited; Monkey 
Limited; Kimpire Limited; A Limited; Nl Limited; RNK Media Company; Megapay Limited; 
Megamusic Limited; Finn Batato Kommunikation; Mega Services Europe Ltd.; Megateam 
Limited; Megastuff Limited; Megacard Inc.; Megasite Inc.; Seventures Limited; SECtravel; and 
Bramos B.V. In addition, the creation and operation of these companies and entities has been 
facilitated and promoted by illicit proceeds from the operations of the Mega Conspiracy. 

THE DEFENDANTS 

30. KIM DOTCOM, who has also been known as KIM SCHMITZ and KIM TIM 
JIM VESTOR, is a resident of both Hong Kong and New Zealand, and a dual citizen of Finland 
and Germany. DOTCOM is the founder of MEGAUPLOAD LIMITED ("MUL") and 
Megamedia Limited ("MMG"). Until on or about August 14, 201 1, DOTCOM was the Chief 
Executive Officer for MUL, and he is currently MUL's Chief Innovation Officer. As the head of 
the Mega Conspiracy, DOTCOM employs more than 30 people residing in approximately nine 
countries. From the onset of the Mega Conspiracy through to the present, DOTCOM has 
supervised the development of the websites and companies utilized in the Mega Conspiracy. 
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DOTCOM directed the creation of the network infrastructure behind the Mega Conspiracy 
websites, negotiated contracts with Internet Service Providers and advertisers, administered the 
domain names used by the Mega Conspiracy, and exercises ultimate control over all decisions in 
the Mega Conspiracy. DOTCOM has arranged millions of dollars in payments for the computer 
servers utilized by the MUL and MMG properties around the world, and has also distributed 
proceeds of the Conspiracy to his co-conspirators. DOTCOM is the director and sole 
shareholder of both VESTOR LIMITED and Kingdom International Ventures Limited, which 
have been used to hold his ownership interests in MUL- and MMG- related properties; for 
example, DOTCOM owns approximately 68% of Megaupload.com , Megaclick.com . and 
Megapix.com, and 100% of the registered companies behind Megavideo.com. Megapom.com . 
and Megapav.com , through VESTOR LIMITED. DOTCOM has personally distributed a link to 
a copy of a copyrighted work on, and has received at least one infringing copy of a copyrighted 
work from, the Mega Sites. Additionally, on numerous instances, DOTCOM received DMCA 
copyright infringement takedown notices from third-party companies. In calendar year 2010 
alone, DOTCOM received more than $42 million from the Mega Conspiracy. 

3 1 . MEGAUPLOAD LIMITED is the registered owner of Megaupload.com . the 
primary website operated by the Mega Conspiracy, and Megaclick.com. a site that offers 
advertising associated with Mega Conspiracy properties. MUL is a registered company in Hong 
Kong with a registry number of 0835 149. MUL has a number of bank accounts in Hong Kong 
that have been used to facilitate the operations of the Mega Conspiracy. DOTCOM, in addition 
to holding the title of Chief Executive Officer of MUL until as recently as August 201 1, owns, 
through VESTOR LIMITED, approximately 68% of the shares of MUL; MATHIAS 
ORTMANN, through Netplus International Limited LLC, owns an additional 25%; JULIUS 
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BENCKO, through Basemax International Limited, owns 2.5%; BRAM VAN DER KOLK 
utilizes Mindpoint International Limited LLC to hold 2.5% of the shares of MUL; 
SVEN ECHTERNACH owns approximately 1%; and the remaining 1% is owned by an investor 
in Hong Kong. 

32. VESTOR LIMITED is a registered company in Hong Kong with a registry 
number of 0994358. VESTOR LIMITED has a DBS Bank account in Hong Kong that has been 
used to facilitate the operations of the Mega Conspiracy. DOTCOM (under the alias KIM TIM 
JIM VESTOR) is the sole director and shareholder of VESTOR LIMITED, and thus is 
effectively the sole director and 68% owner of MUL, Megaupload.com . Megaclick.com . and 
Megapix.com . DOTCOM is the sole director of, and VESTOR LIMITED is the sole 
shareholder of, MMG, which is the parent company and sole shareholder of the following 
companies: Megavideo Limited (which is the registered owner of Megavideo.com) . 
Megarotic Limited (which is the registered owner of Megaporn.com ). and Megapay Limited. 
VESTOR LIMITED is also the sole owner of Megaworld.com . 

33. FINN BATATO is both a citizen and resident of Germany. BATATO is the 
Chief Marketing and Sales Officer for Megaupload.com and other Mega Conspiracy properties. 
Specifically, BATATO is in charge of selling advertising space, primarily through 
Megaclick.com . BATATO supervises a team of approximately ten sales people around the 
world. The purpose of the sales team is to increase the advertising revenue in localized markets 
by targeting certain advertisements in certain countries. BATATO handles advertising 
customers on the Megaclick.com website and approves advertising campaigns for 
Megaupload.com , Megavideo.com , and Megaporn.com . BATATO has personally distributed a 
link to at least one infringing copy of a copyrighted work to a Mega Site. Additionally, on 
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numerous instances, B ATATO received DMCA copyright infringement takedown notices from 
third-party companies. In calendar year 2010, B ATATO received more than $400,000 from the 
Mega Conspiracy. 

34. JULIUS BENCKO is both a citizen and resident of Slovakia. BENCKO is the 
Graphic Director for MUL and MMG. BENCKO, as the director and sole shareholder of 
Basemax International Limited, is effectively a 2.5% shareholder of MUL. From the onset of the 
Conspiracy through to the present, BENCKO has been the lead graphic designer of the 
Megaupload.com and other Mega Conspiracy websites. He has designed the Megaupload.com 
logos, the layouts of advertisement space, and the integration of the Flash video player. 
BENCKO has requested and received at least one infringing copy of a copyrighted work as part 
of the Mega Conspiracy. In calendar year 2010, BENCKO received more than $1 million from 
the Mega Conspiracy. 

35. SVEN ECHTERNACH is both a citizen and resident of Germany. 
ECHTERNACH is the Head of Business Development for MMG and MUL. ECHTERNACH is 
a 1% shareholder in MUL. ECHTERNACH leads the Mega Team company, registered in the 
Philippines, which is tasked with removing illegal or abusive content from the Mega Conspiracy 
websites, reviewing advertising campaigns for inappropriate content, and responding to 
customer support e-mails. Additionally, ECHTERNACH handles the Mega Conspiracy's 
relationships with electronic payment processors, accounting firms, and law firms. His activities 
include traveling and approaching companies for new business ventures and services. 
Additionally, on numerous instances, ECHTERNACH received DMCA copyright infringement 
takedown notices from third-party companies. In calendar year 2010, ECHTERNACH received 
more than $500,000 from the Mega Conspiracy. 
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36. MATHIAS ORTMANN is a citizen of Germany and a resident of both Germany 
and Hong Kong. ORTMANN is the Chief Technical Officer, co-founder, and a director of 
MUL. ORTMANN, as the director and sole shareholder of Netplus International Limited LLC, 
effectively owns 25% of the shares of MUL. From the onset of the Conspiracy through to the 
present, ORTMANN has overseen software programmers that developed the Mega Conspiracy's 
websites, and has handled technical issues with the ISPs. His particular areas of responsibility 
include setting up new servers, sending and responding to equipment service requests, and 
problem solving connectivity problems with the Mega Conspiracy websites. Additionally, on 
numerous occasions, ORTMANN received DMCA copyright infringement takedown notices 
from other conspirators and third-party companies. ORTMANN also had authority to distribute 
funds from one of the Conspiracy's main financial accounts. ORTMANN has received a link to 
a copy of a copyrighted work associated with the Mega Conspiracy. In calendar year 2010 
alone, ORTMANN received more than $9 million from the Mega Conspiracy. 

37. ANDRUS NOMM is a citizen of Estonia and a resident of both Turkey and 
Estonia. NOMM is a software programmer and Head of the Development Software Division for 
MUL. NOMM is responsible for the technical aspects of Megaclick.com . NOMM develops 
new projects, tests code, and provides routine maintenance for the site. Additionally, NOMM 
provides web coding assistance to various projects on other Mega Conspiracy websites. Such 
projects have included testing high definition video on Megavideo.com . installing the thumbnail 
screen captures for uploaded videos, and transferring still images across the various Mega 
Conspiracy website platforms. NOMM has accessed at least one infringing copy of a 
copyrighted work from a computer associated with the Mega Conspiracy. In calendar year 2010, 
NOMM received more than $100,000 from the Mega Conspiracy. 
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38. BRAM VAN DER KOLK, who has also been known as BRAMOS, is a resident 
of both the Netherlands and New Zealand. VAN DER KOLK is a Dutch citizen. VAN DER 
KOLK is the "Programmer-in-Charge" for MUL and MMG. VAN DER KOLK, as the director 
and sole shareholder of Mindpoint International Limited LLC, effectively owns 2.5% of the 
shares of MUL. From the onset of the Conspiracy through to the present, VAN DER KOLK has 
overseen programming on the Mega Conspiracy websites, as well as the underlying network 
infrastructure. VAN DER KOLK is also responsible for responding to DMCA copyright 
infringement takedown notices sent to Mega Conspiracy sites. Lastly, VAN DER KOLK 
oversaw the selection of featured videos that were posted onto Megavideo.com . and he was 
previously in charge of the rewards program. VAN DER KOLK has personally uploaded 
multiple infringing copies of copyrighted works to Internet sites associated with the Mega 
Conspiracy and has searched servers controlled by the Mega Conspiracy for infringing copies 
of copyrighted works at the request of other co-conspirators, including several of the 
defendants. In calendar year 2010, VAN DER KOLK received more than $2 million from the 
Mega Conspiracy. 

THIRD-PARTIES 

39. Carpathia Hosting rCarpathia.com) is an Internet hosting provider that is 
headquartered in Dulles, Virginia, which is in the Eastern District of Virginia. Carpathia Hosting 
has access to datacenters in Ashburn, Virginia; Harrisonburg, Virginia; Phoenix, Arizona; Los 
Angeles, California; and Toronto, Canada. The Mega Conspiracy leases approximately 

25 petabytes 3 of data storage from Carpathia to store content associated with the Mega Sites. 
More than 1,000 computer servers in North America are owned and operated by Carpathia 



3 A petabyte is more than 1,000 terabytes, or one million gigabytes. 
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Hosting for the benefit of the Mega Conspiracy; more than 525 of these computer servers are 
currently located in Ashburn, Virginia, which is in the Eastern District of Virginia. Carpathia 
Hosting continued to provide the Mega Conspiracy with leased computers, Internet hosting, and 
support services as of January 19, 2012. 

40. Cogent Communications (Cogentco.com) is a multinational Internet hosting and 
bandwidth provider that is headquartered in Washington, D.C., but also has offices and facilities 
in the Eastern District of Virginia. As one of the top five global Internet service providers, 
Cogent Communications owns and operates 43 datacenters around the world. The Mega 
Conspiracy leases approximately thirty-six computer servers in Washington, D.C. and France 
from Cogent Communications that are used for the Mega Sites. Cogent Communications 
continued to provide the Mega Conspiracy with leased computers, Internet bandwidth, hosting, 
and support services as of January 19, 2012. 

41 . Leaseweb ( Leaseweb.com) is a multinational Internet hosting provider that is 
headquartered in the Netherlands. Leaseweb has eight datacenters in the Netherlands, Belgium, 
Germany, and the United States, including in the Eastern District of Virginia. More than 630 
computer servers in the Netherlands are owned and hosted by Leaseweb for the benefit of the 
Mega Conspiracy, and an additional sixty servers hosted at Leaseweb were purchased by the 
Mega Conspiracy in October 201 1 . Leaseweb continued to provide the Mega Conspiracy with 
leased computers, Internet hosting, and support services as of January 19, 2012. 

42. PayPal, Inc. (PavPal.com ) is a U.S. -based global e-commerce business allowing 
payments and money transfers over the Internet; in fact, PayPal Inc. indicates that it is involved 
in approximately 15% of global e-commerce. The Mega Conspiracy's PayPal, Inc. account has 
been utilized to receive payments from the Eastern District of Virginia and elsewhere for 
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premium Megaupload.com subscriptions, which have included fees of $9.99 for monthly 
subscriptions, $59.99 for yearly subscriptions, and $199.99 for lifetime subscriptions. The same 
PayPal, Inc. account has been used by the Conspiracy to pay Carpathia Hosting in the United 
States and Leaseweb in the Netherlands as well as other operating expenses (including, but not 
limited to, direct financial rewards to uploaders of popular content in the Eastern District of 
Virginia and elsewhere). From on or about November 25, 2006, through on or about July 20 1 1 , 
the PayPal, Inc. account for the Mega Conspiracy has received in excess of $1 10,000,000 from 
subscribers and other persons associated with Mega Conspiracy. 

43. Moneybookers Limited (Monevbookers.com') is an United Kingdom-based global 
e-commerce business allowing payments and money transfers over the Internet. The Mega 
Conspiracy has charged various rates through Moneybookers Limited for premium subscriptions 
on its websites, including €9.99 for monthly subscriptions, €59.99 for yearly subscriptions, or 
€199.99 for lifetime subscriptions. Between August 1, 2010 and July 31, 201 1, the 
Moneybookers Limited accounts for the Mega Conspiracy have collected in excess of $5 million 
from subscribers of Mega Sites and transferred that money to an account in Hong Kong 
associated with the Mega Conspiracy. 

44. AdBrite, Inc. (AdBrite.com ) is an online advertising network based in San 
Francisco, California. AdBrite, Inc. provides advertisements for over 100,000 Internet sites and 
is believed to be amongst the top ten advertising networks on the Internet. From on or about 
September 2, 2005 until on or about May 24, 2008, AdBrite paid at least $840,000 to the Mega 
Conspiracy for advertising. 

45. PartyGaming pic is a company based in the United Kingdom that has operated 
PartvPoker.com since 2001 . PartvPoker.com has more than 3 million visitors annually and is 
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one of the largest online poker rooms. PartyGaming's advertising contract with the members of 
the Mega Conspiracy was initiated on or about November 12, 2009 and has resulted in payments 
of more than $3,000,000 to the Conspiracy. This contract was still active as recently as on or 
aboutMarchl8,2011. 
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COUNT ONE 

(18 U.S.C. § 1962(d) - Conspiracy to Commit Racketeering) 
THE GRAND JURY CHARGES THAT: 

46. Paragraphs 1 through 45 are re-alleged and incorporated as if set forth here in 
their entirety. 

A. THE ENTERPRISE 

47. Beginning in at least September 2005 and continuing until at least January 19, 
2012, in the Eastern District of Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINN BATATO, 
JULIUS BENCKO, 
SVENECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM,and 
BRAM VAN DER KOLK 
and others known and unknown to the Grand Jury, constituted an "enterprise," as defined by 
Title 18, United States Code, Section 1961(4) (hereinafter the "Enterprise"), that is, a group of 
individuals and entities associated in fact. The Enterprise further included all associated 
corporations, affiliates, subsidiaries, and entities, including, but not limited to, those indicated in 
paragraph 29. The Enterprise constituted an ongoing organization whose members functioned as 
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a continuing unit for the common purpose of achieving the objectives of the Enterprise. This 
Enterprise was engaged in, and its activities affected, interstate and foreign commerce. 
B. THE RACKETEERING VIOLATION 

48. Beginning in at least September 2005 and continuing until January 19, 2012, in 
the Eastern District of Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINNBATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
being persons employed by and associated with the Enterprise, which Enterprise engaged in, and 
the activities of which affected interstate and foreign commerce, did knowingly, willfully, and 
intentionally combine, conspire, confederate, and agree together and with each other, and with 
other persons known and unknown to the Grand Jury, to violate 18 U.S.C. § 1962(c) (hereinafter 
the "Racketeering Violation"), that is, to conduct and participate, directly and indirectly, in the 
conduct of the affairs of that Enterprise through a pattern of racketeering activity, as that term is 
defined in Title 18, United States Code, Section 1961(1) and (5), involving multiple acts 
indictable under: 
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a. 18 U.S.C. §§ 2319(b)(1) & 2319(d)(2); 17 U.S.C. §§ 506(a)(1)(A) & 
506(a)(1)(C) (criminal copyright infringement); 

b. 18 U.S.C. §§ 1956(a)(l)(A)(i), 1956(a)(2)(A), 1956(h), 1956(f), and 1957 
(money laundering); and 

c. 18 U.S.C. § 1343 (fraud by wire). 

C. PURPOSES OF THE ENTERPRISE 

49. The purposes of the Enterprise included the following: 

a. Enriching the members and associates of the Enterprise through, among 
other things, copyright infringement, money laundering, and wire fraud. 

b. Promoting, enlarging, and enhancing the Enterprise and its members' and 
associates' activities. 

D. MEANS AND METHODS OF THE ENTERPRISE 

50. Among the means and methods by which the defendants and their associates 
conducted and participated in the conduct of the affairs of the Enterprise were the following: 

a. Members of the Enterprise and their associates criminally infringed 
copyrights, aided and abetted copyright infringement, and conspired to 
infringe copyrights, which affected interstate and foreign commerce; 

b. Members of the Enterprise and their associates committed money 
laundering, attempted to commit money laundering, and conspired to 
commit money laundering to facilitate and expand the Enterprise's 
criminal operations, which affected interstate and foreign commerce; 
and 

c. Members of the Enterprise and their associates devised a scheme to 
defraud, committed wire fraud, aided and abetted wire fraud, and 
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attempted to commit wire fraud, which affected interstate and foreign 
commerce. 



(All in violation of Title 18, United States Code, Section 1962(d)) 
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COUNT TWO 

(18 U.S.C. § 371 - Conspiracy to Commit Copyright Infringement) 
THE GRAND JURY CHARGES THAT: 

5 1 . The factual allegations contained in Paragraphs 1 through 45 are re-alleged and 
incorporated as if set forth here in their entirety. 

52. Beginning in at least September 2005 and continuing until at least January 19, 
2012, in the Eastern District of Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINN BATATO, 
JULIUS BENCKO, 
SVENECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
each knowingly and intentionally combined, conspired, and agreed together and with each other, 
and with other persons known and unknown to the Grand Jury, to: (1) willfully infringe, for 
purposes of commercial advantage and private financial gain, at least ten copies and 
phonorecords of one or more copyrighted works with a total retail value of more than $2,500 
within a 180-day period, in violation of Title 17, United States Code, Section 506(a)(1)(A) and 
Title 18, United States Code, Section 2319(b)(1); and (2) willfully infringe, for purposes of 
commercial advantage and private financial gain, a copyright by the distribution of a work being 
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prepared for commercial distribution, by making it available on a computer network accessible to 
members of the public, when the defendants knew and should have known that the work was 
intended for commercial distribution, in violation of Title 17, United States Code, Section 
506(a)(1)(C) and Title 18, United States Code, Section 2319(d)(2). 

Ways, Manner, and Means of the Conspiracy 
In furtherance of the Conspiracy, defendants and others known and unknown to the 
Grand Jury employed, among others, the following manner and means: 

53. It was part of the Conspiracy that the defendants and their co-conspirators 
operated a number of Internet sites and associated services, including Megaupload.com . 
Megavideo.com, and Megaclick.com . 

54. It was further part of the Conspiracy that members of the Conspiracy had the 
ability to search files that were on the computer systems they controlled. The records kept by the 
Conspiracy included, but were not limited to, the identity of the user who uploaded the content, 
the date it was uploaded, the MD5 hash value for the file, the Mega Conspiracy-created links that 
pointed to the content, the size of the file, the name the user provided for the file, the apparent 
number of times the file had been downloaded (until August 31, 2010), and whether a copyright 
infringement notice had been received for any link associated with the content file. 

55. It was further part of the Conspiracy that the content available on 
Megaupload.com and Megavideo.com was provided by known and unknown members of the 
Mega Conspiracy, including several of the defendants, who uploaded infringing copies of 
copyrighted works onto computer servers leased by the Mega Conspiracy in North America to 
further the reproduction and distribution of copyrighted works; in particular, copyright infringing 
content was reproduced and distributed by the Conspiracy using various servers in Toronto, 
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Canada; Los Angeles, California; and Ashburn, Virginia (the last of which is in the Eastern 
District of Virginia). 

56. It was further part of the Conspiracy that content was also reproduced on and 
distributed from computer servers leased or owned by the Mega Conspiracy in France and 
the Netherlands. 

57. It was further part of the Conspiracy that the Conspiracy made no significant 
effort to identify and block users who were using the Mega Sites or services to infringe 
copyrights, to prevent the uploading of infringing copies of copyrighted materials, or to identify 
infringing copies of copyrighted works located on computer servers controlled by the 
Conspiracy. 

58. It was further part of the Conspiracy, from at least September 2005 until July 
201 1, that the Conspiracy provided financial incentives for users to upload infringing copies of 
popular copyrighted works. The Conspiracy made payments to uploaders who were known to 
have uploaded infringing copies of copyrighted works, as well as repeat infringers. 

59. It was further part of the Conspiracy that it designed its computer systems to 
automatically reproduce additional copies of some works that had originally been uploaded by 
individual users and distributed these additional copies to multiple computer servers under the 
control of the Conspiracy around the world, including to computer servers that were specifically 
designed to rapidly mass distribute files. 

60. It was further part of the Conspiracy that members of the Conspiracy monitored 
the public actions of law enforcement regarding large-scale copyright infringement and took 
active steps to conceal the copyright-infringing activities taking place on the Mega Sites. 
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61. It was further part of the Conspiracy that the members of the Conspiracy 
misrepresented to the Conspiracy's users and the public the nature of the files that were 
contained on the computer servers it controlled and of the amount of their network bandwidth 
associated with known or obvious infringement. 

62. It was further part of the Conspiracy that members of the Conspiracy purposefully 
did not provide full and accurate search results to the public, or, in the case of Megaupload.com. 
chose not to provide any search functionality at all in order to conceal the fact that the primary 
purpose of the website and service was to reproduce and distribute infringing copies of 
copyrighted works for commercial advantage and private financial gain. 

63. It was further part of the Conspiracy that members of the Conspiracy reproduced 
copyrighted works directly from third-party websites, including from YouTube.com. to make 
them available for reproduction and distribution on Megavideo.com .. and to create the false 
impression that Megavideo.com hosted primarily user generated content instead of copyright- 
infringing content. 

64. It was further part of the Conspiracy that members of the Conspiracy generally 
did not terminate the user accounts of known copyright infringing users, when it had the right 
and ability under its Terms of Service to do so. 

65. It was further part of the Conspiracy that members of the Conspiracy generally 
did not delete infringing copies of copyrighted works from computer servers that they controlled, 
even when they were aware of the infringing material or the removal of that content was 
specifically requested by the copyright holder. 

66. It was further part of the Conspiracy that members of the Conspiracy responded 
on a selective basis to requests to remove infringing content (or access thereto) from the 
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computer servers they controlled, and sometimes deliberately did not remove copyrighted works 
(or even links thereto) when it would result in a loss of revenue. 

67. It was further part of the Conspiracy that members of the Conspiracy told 
copyright holders and their representatives that it would remove infringing content the holders 
and their representatives identified from the servers the Conspiracy controlled, when the 
members of the Conspiracy knew they would not. In particular, members of the Conspiracy 
deliberately misrepresented to copyright holders that they had removed copyright infringing 
content from their servers, while, in fact, they only removed certain links to the content file 
(which could still be illegally downloaded through numerous redundant links). Redundant links 
were sometimes even created by members of the Conspiracy. 

68. It was further part of the Conspiracy that members of the Conspiracy told 
complaining rights holders and their representatives that the members of the Conspiracy had 
deleted or blocked the user accounts of known and repeat copyright infringing users, when they 
had not. 

69. It was further part of the Conspiracy that the computer systems operated by 
members of the Conspiracy allowed the uploading of many hundreds of thousands of infringing 
copies of copyrighted files from anonymous users and the Conspiracy has financially profited 
from the distribution of these files. 

70. It was further part of the Conspiracy that the computer systems operated by 
members of the Conspiracy have been used to distribute many hundreds of thousands of 
infringing copies of copyrighted works to anonymous users and the Conspiracy has financially 
profited from those distributions. 
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71. It was further part of the Conspiracy that infringing copies of many thousands of 
copyrighted works on Megaupload.com and Megavideo.com were made available to tens of 
millions of visitors each day. 

72. It was further part of the Conspiracy that the Conspiracy derived a direct 
financial benefit from infringement through the advertising that was placed on the Mega Sites 
and from "premium" subscription charges. Between September 2005 and January 5, 2012, the 
defendants collectively have received more than $175 million from advertising and 
subscriptions. 

Overt Acts 

73 . It was further part of the Conspiracy that the following acts in furtherance of and 
to effect the objects of the above-described Conspiracy were committed in the Eastern District of 
Virginia and elsewhere: 

a. From at least November 24, 2006 until at least January 19, 2012, 
infringing copies of copyrighted materials were stored on computer servers located at Carpathia 
Hosting in Ashburn, Virginia, which is in the Eastern District of Virginia. 

b. For the 180 days up to and including January 19, 2012, members of the 
Conspiracy infringed copyrights, in the Eastern District of Virginia and elsewhere, by 
reproducing and distributing by electronic means at least ten copies and phonorecords of one or 
more copyrighted works which had a total retail value of more than $2,500 for purposes of 
commercial advantage and private financial gain. 

c. For the 1 80 days up to and including August 3 1 , 20 1 0, members of the 
Conspiracy infringed copyrights, in the Eastern District of Virginia and elsewhere, by 
reproducing and distributing by electronic means at least ten copies and phonorecords of one or 
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more copyrighted works which had a total retail value of more than $2,500 for purposes of 
commercial advantage and private financial gain. 

d. For the 180 days up to and including August 16, 2008, members of the 
Conspiracy infringed copyrights, in the Eastern District of Virginia and elsewhere, by 
reproducing and distributing by electronic means at least ten copies and phonorecords of one or 
more copyrighted works which had a total retail value of more than $2,500 for purposes of 
commercial advantage and private financial gain. 

e. For the 1 80 days up to and including October 3 1 , 2007, members of the 
Conspiracy infringed copyrights, in the Eastern District of Virginia and elsewhere, by 
reproducing and distributing by electronic means at least ten copies and phonorecords of one or 
more copyrighted works from the Youtube.com platform which had a total retail value of more 
than $2,500 for purposes of commercial advantage and private financial gain, 

f. During the course of the Conspiracy, the Mega Conspiracy has paid more 
than $65 million to hosting providers around the world for computer leasing, hosting, bandwidth, 
and support services. The amounts of some of these payments are detailed in Count Three, and 
incorporated herein by reference. These payments involved the use of proceeds of criminal 
copyright infringement to promote the objects of the conspiracy. 

g. From at least September 2005 until July 201 1, the Mega Conspiracy 
offered and provided financial incentives to its premium subscribers to upload copies of popular 
works to Megaupload.com and then distribute links that provided a download of that file, with a 
single click, to anyone on the Internet. Though the "Uploader Rewards" program warned that 
the uploading of copyrighted files would result in disqualification, the Mega Conspiracy rarely, 
if ever, terminated the accounts of individuals who posted copyrighted content. In fact, the Mega 
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Conspiracy affirmatively chose to financially reward specific uploaders of infringing copies of 
copyrighted content, including repeat offenders. 

h. An early version of the "Uploader Rewards" program for 

Megauploadxom from approximately September 2005 announced: "Today we are also 

introducing our ground breaking Uploader Rewards. Our new reward program pays money and 

cash prizes to our uploaders. This makes Megaupload the first and only site on the Internet 

paying you for hosting your files. The more popular your files the more you make." Directly 

addressing "file traders," the announcement continued: "You deliver popular content and 

successful files [.] We provide a power hosting and downloading service. Let's team up!" In 

addition, the announcement stated: "You must have at least 50000 downloads within 3 months 

to qualify" and "You must allow us to list your files & descriptions on our Top 100 pages." The 

rewards included "$1 USD Cash per 1000 downloads of your uploaded files", plus an additional 

bonus between $50 to $5,000 for Top 100 "Megauploaders with the most downloads" during a 

three-month period, to be paid through PayPal according to the following ranking: 

Rankl: $5,000 USD Bonus 
Ranks 2-5: $1,000 USD Bonus 
Ranks 6-10: $500 USD Bonus 
Ranks 11-50: $100 USD Bonus 
Ranks 51-100: $50 USD Bonus 

i. A later version of the "Uploader Rewards" program, available at least as 

early as November 2006, offered the following: "For every download of your files, you earn 1 

reward point. * You can redeem your reward points for premium services and cash[.]" The 

program required "a premium membership to qualify for a payment." Rewards were paid 

through PayPal according to the following reward point totals: 

5,000 reward points: One day premium 
50,000 reward points: One month premium 
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100,000 reward points: One year premium 
500,000 reward points: Lifetime platinum + $300 USD 
1 ,000,000 reward points: $ 1 ,000 USD 
5,000,000 reward points: $10,000 USD 

j. At the time of its termination, as recently as July 201 1 , the "Uploader 

Rewards" program offered rewards according to the following reward point totals: 

10,000 reward points: One month premium membership 
50,000 reward points: 6 months premium membership 
1 00,000 reward points: One year premium + $ 1 00 USD 
500,000 reward points: Lifetime platinum + $500 USD 
1,000,000 reward points: $1,500 USD 
5,000,000 reward points: $10,000 USD 

k. In approximately April 2006, members of the Mega Conspiracy copied 
videos directly from Youtube.com to make them available on Megavideo.com . 

1. On or about April 1 0, 2006, VAN DER KOLK sent an e-mail to 
ORTMANN asking "Do we have a server available to continue downloading of the Youtube's 
vids? . . . Kim just mentioned again that this has really priority." 

m. On or about April 10, 2006, VAN DER KOLK sent an e-mail to 
ORTMANN indicating "Hope rYoutube.com is] not implementing a fraud detection system 
now... * praying *". 

n. On or about April 1 0, 2006, ORTMANN sent an e-mail to VAN DER 
KOLK in reply to the "fraud detection" message indicating "Even if they did, the usefulness of 
their non-popular videos as a jumpstart for Megavideo is limited, in my opinion." 

o. On or about April 1 0, 2006, VAN DER KOLK sent an e-mail to 
ORTMANN in reply to the "jumpstart for Megavideo" message indicating that "Well we only 
have 30% of their videos yet.. In my opinion it's nice to have everything so we can descide and 
brainstorm later how we're going to benefit from it." 
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p. On or about May 2, 2006, an e-mail was sent from the "Megaupload 
Abuse Desk" to a representative of a copyright holder falsely representing that the representative 
could "remove a batch of files from our servers" by using the Abuse Tool. 

q. On or about May 1 0, 2006, a member of the Mega Conspiracy registered 
the Internet domain Megaclick.com . 

r. On or about August 3 1 , 2006, VAN DER KOLK sent an e-mail to an 
associate entitled "lol". Attached to the message was a screenshot of a Megaupload.com file 
download page for the file "Alcohol 120 1.9.5 3105complete.rar" with a description of "Alcohol 
120, con crack!!!! By ChaOtiX!". The copyrighted software "Alcohol 120" is a CD/DVD 
burning software program sold by www.alcohol-soft.com . 

s. On or about November 1 3, 2006, VAN DER KOLK sent an e-mail to 
another individual that contained 100 Megaupload.com links to infringing copies of copyrighted 
musical recordings by the artist Armin van Buuren. 

t. On or about November 13, 2006, a member of the Mega Conspiracy 
registered the Internet domain Megavideo.com . 

u. On or about December 3, 2006, DOTCOM distributed a Megaupload.com 
link to a music file entitled "05-50_cent_feat._mobb_deep-nah-c4.mp3" to ORTMANN. A 
copy of this file was still present on servers controlled by the Mega Conspiracy as of 
December 20, 2011. 

v. On or about February 5, 2007, VAN DER KOLK sent an e-mail to 
ORTMANN entitled "reward payments". Attached to the e-mail was a text file listing the 
following proposed reward amounts^ the Megaupload.com username, and the content 
they uploaded: 
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1 00 USD [USERNAME DELETED] 1 0+ Full popular DVD rips (split files), a few 
small porn movies, some software with keygenerators (warez) 

100 USD [USERNAME DELETED] 5845 files in his account, mainly Vietnamese 
content 

1 00 USD [USERNAME DELETED] Popular DVD rips 
100 USD [USERNAME DELETED] Some older DVD rips + unknown (Italian 
serries?) rar files 

1 500 USD [USERNAME DELETED] known paid user (Vietnamese content) 
The last individual received at least $55,000 from the Mega Conspiracy through transfers from 
PayPal Inc., as part of the "Uploader Rewards" program. 

w. On or about February 1 1 , 2007, VAN DER KOLK sent an e-mail to 
ORTMANN indicating that "Kim really wants to copy Youtube one to one." 

x. On or about February 13, 2007, ORTMANN sent an e-mail to VAN DER 
KOLK entitled "my concerns about the thumbnails table." In the e-mail, ORTMANN asked 
VAN DER KOLK to create "a dummy lifetime premium user," stating that "[t]his is very 
important to prevent the loss of source files due to expiration or abuse reports." 

y . On or about February 2 1 , 2007, VAN DER KOLK sent an e-mail to 
ORTMANN entitled "2 reward payment files." Attached to the e-mail was a file containing 
Megaupload.com users' e-mail addresses and reward payments for that time period, which 
ranged from $100 to $500. For one user that was paid $300, VAN DER KOLK wrote, "30849 
files, mainly Mp3z, some copyrighted but most of them have a very small number of downloads 
per file." For other users, all of which were selected for reward payments of $100 by the Mega 
Conspiracy, he wrote the following: "Our old famous number one on MU, still some illegal files 
but I think he deserves a payment"; "Loads of PDF files (looks like scanned magazines)"; "looks 
like Vietnamese DVD rips"; "This user was paid last time has mainly split RAR files, however 
more than 50% deleted through abuse reports." 
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z. From on or about March 1, 2007, through July 3, 2010, payments totaling 
approximately $13 million were transferred in and affecting interstate and foreign commerce 
through PayPal, Inc. by a member of the Mega Conspiracy to WR, the Chief Financial Officer 
of Carpathia Hosting in Ashburn, Virginia, which is in the Eastern District of Virginia, for 
computer leasing, hosting, and support services. The details of these payments are described 
more specifically in Count Three and incorporated herein by reference. 

aa. From on or about March 2, 2007, through July 3, 2010, payments totaling 
at least $9 million were transferred in and affecting interstate and foreign commerce through 
PayPal, Inc. by a member of the Mega Conspiracy to Leaseweb in the Netherlands for computer 
leasing, hosting, and support services. The details of these payments are described more 
specifically in Count Three and incorporated herein by reference. 

bb. On or about April 15, 2007, VAN DER KOLK sent an e-mail to 
ORTMANN entitled "reward batch payment." In the e-mail, VAN DER KOLK stated: "We 
saved more than half of the money. Most of the disqualifications were based on fraud 
(automated mass downloads). The other disqualifications had very obvious copyrighted files in 
their account portfolio, but I was rather flexible (considering we saved quite a lot on fraud 
already). Total cost: 5200 USD." Attached to the e-mail was a file containing the 
Megaupload.com users' e-mail addresses and selected reward payments for that time period, 
which ranged from $100 to $1,500. 

cc. On or about May 17, 2007, a representative from Google AdSense, an 
Internet advertising company, sent an e-mail to DOTCOM entitled "Google AdSense Account 
Status." In the e-mail, the representative stated that "[d]uring our most recent review of your site 
[Megaupload.com Q" Google AdSense specialists found "numerous pages" with links to, among 
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other things, "copyrighted content," and therefore Google AdSense "will no longer be able to 
work with you." The e-mail contains links to specific examples of offending content located on 
Megaupload.com . DOTCOM and his conspirators have continued to operate and financially 
profit from the Megaupload.com website after receiving this notice. 

dd. On or about July 1 , 2007, the Mega Conspiracy publicly launched the 
Megavideo.com website. 

ee. On or about August 12, 2007, VAN DER KOLK sent an e-mail to 
ORTMANN regarding a particular file located on Megaupload.com . The file was a music video, 
entitled "soulja_boy-crank_dat_soulja_boy_(superman)-[zGalaxy_Xvid].avi." In the e-mail, 
VAN DER KOLK copied information about the file from the Megaupload.com internal database, 
which contains, among other things, the following: file name; file extension type (e.g., .avi, jpg, 
etc.); file size; date; rank; the file's 32-digit identification number, also referred to as a MD5 
hash; and the file's 8-digit download number for use with the Megaupload.com link 
(for example, the last eight digits of the following: www.megaupload.com/?d=B Yl 5XE3 V ). 

ff. On or about August 14, 2007, an e-mail was sent from "Megavideo 
Support" to a copyright holder (who complained that videos from his Youtube.com channel 
appeared to have been infringed by two users on Megavideo.com) that falsely represented that 
the Mega Conspiracy had blocked the two user accounts, when these two accounts were still 
active on January 19, 2012. 

gg. On or about August 1 5, 2007, BENCKO sent VAN DER KOLK an e-mail 
message indicating "the sopranos is in French :((( [expletive deleted]., can u pis find me some 
again ?" "The Sopranos" is a copyrighted television series that previously aired on the premium 
channel Home Box Office. 
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hh. On or about August 1 5, 2007, an e-mail was sent from "Megavideo 
Support" to a copyright holder (who complained that videos from his Youtube.com channel 
appeared to have been infringed by a user on Megavideo.com ) that falsely represented that the 
Mega Conspiracy had blocked the two user accounts, when these two accounts were still active 
on January 19, 2012. 

ii. On or about August 1 5, 2007, an e-mail was sent from "Megavideo 
Support" to a copyright holder (who complained that videos from his Youtube.com channel - as 
well as those of other Youtube.com users - appeared to have been infringed by a user of 
Megavideo.com ) that falsely represented that the Mega Conspiracy had blocked the user's 
account, when the account was still active on January 19, 2012. 

jj. On September 29, 2007 and again on March 1 1 , 2009, a member of the 
Mega Conspiracy made transfers in and affecting interstate and foreign commerce through 
PayPal, Inc. to PA, a resident of Newport News, Virginia, which is in the Eastern District of 
Virginia, as part of the Mega Conspiracy's "Uploader Rewards" program. Specifically, this 
individual received a transfer of $1,500 on each of these dates from the Mega Conspiracy (for a 
total of $3,000). 

kk. On or about October 4, 2007, BENCKO sent VAN DER KOLK an e-mail 
message entitled "pis" requesting "can u pis get me some links to the series called 'Seinfeld' 
from MU?" "Seinfeld" is a copyrighted television series that remains in syndication. 

11. On or about October 1 8, 2007, BENCKO sent an e-mail to VAN DER 
KOLK indicating that "sorry to bother but if you would have a second to find me some links for 
the "Grand Archives" band id be very happy." On or about the same day, VAN DER KOLK 
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responded to BENCKO with an e-mail that contained a Megaupload.com link to a Grand 
Archives music album with the statement "That's all we have. Cheers mate!" 

mm. On or about December 1 1 , 2007, a credit card payment processor e-mailed 
ECHTERNACH and VAN DER KOLK regarding "complaints" that the processor had received 
from third-parties, including one in which a third-party stated, "we have pulled over 65 full 
videos from Megarotic. That's $200k in content we paid for." In the e-mail, the processor 
stated, among other things: "you are not allowed to sell or financially benefit from the content 
that is infringing in copyrights on your site"; and "you are not allowed to continue with allowing 
the user to upload content if you can have knowledge of the infringing of copyright." DOTCOM 
responded to the e-mail, stating "The DMCA quotes you sent me are not relevant. We are a 
hosting company and all we do is sell bandwidth and storage. Not content. All of the content on 
our site is available for "free download"." 

nn. On or about December 12, 2007, BATATO distributed a Megaurjload.com 
link to an infringing copy of the copyrighted music file "Louis Armstrong - We have all the time 
in the world.mp3" to DOTCOM. An infringing copy of this copyrighted work was still present 
on servers leased by the Mega Conspiracy as of September 2, 201 1 . 

oo. On or about January 25, 2008, an e-mail was sent from the "Megaupload 
Abuse Department" to a representative of a copyright holder falsely representing that the 
"takedown tool" would "remove" videos and/or files "from our system immediately." 

pp. Starting as early as January 27, 2008, a member of the Mega Conspiracy 
made multiple transfers in and affecting interstate and foreign commerce through PayPal, Inc. to 
CB, a resident of Alexandria, Virginia, which is in the Eastern District of Virginia, as part of the 
Mega Conspiracy's "Uploader Rewards" program. CB received total payments from the 
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Conspiracy of $500, including transfers of $100 on January 27, 2008; $300 on October 8, 2009; 
and $100 on February 1, 2010. 

qq. Starting as early as February 1 1 , 2008, a member of the Mega Conspiracy 
made multiple transfers in and affecting interstate and foreign commerce through PayPal, Inc. to 
ND, a resident of Falls Church, Virginia, which is in the Eastern District of Virginia, as part of 
the Mega Conspiracy's "Uploader Rewards" program. ND received total payments from the 
Conspiracy of $900, including transfers of $100 on February 11, 2008; $100 on March 3, 2008; 
$300 on March 15, 2008; $100 on March 29, 2008; and $300 on April 15, 2008. 

rr. On or about May 6, 2008, an e-mail was sent from the "Megaupload 
Abuse Desk" to a representative of a copyright holder falsely representing that Megavideo was 
"one of the few online video communities that ma[de] it impossible to fraudulently host full- 
length feature movies due to a human-assisted automatic detection/deletion mechanism." 

ss. On or about May 6, 2008, an e-mail was sent from the "Megaupload 
Abuse Desk" to a representative of a copyright holder falsely representing that the use of the 
Abuse Tool would provide "direct deletion rights, which will completely bypass our abuse team 
and take files and films offline immediately." 

tt. On or about May 1 2, 2008, an e-mail was sent from 
"megsupp@googlemail.com On Behalf Of Megaupload Support" to a representative of a 
copyright holder falsely representing, "We are taking great care in expeditiously deleting any 
material reported to us through DMCA takedown notices." 

uu. On or about June 19, 2008, a representative of various copyright owners 
sent an e-mail to dmca@megavideo.com , stating that a particular premium user (herein "VV") 
was "currently hosting at least 57 full content movies without the authorization from the 
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copyright holders," and that VV "appears to be using your services to profit from our clients' 
intellectual property." In addition, the representative stated that "we have already sent over 85 
notices of copyright infringement to MegaVideo.com" regarding VV, and that VV should be 
considered a "Repeat infringer Q." 4 Despite these repeated infringement notifications, the Mega 
Conspiracy's internal records reflect no deletions of any of VV's uploaded files; furthermore, 
PayPal, Inc. records show that the Conspiracy made five payments totaling $3,400 to VV starting 
in mid-March 2008 and continuing into late 2009 as part of the Uploader Rewards program. 
During the nearly six years that VV has been a registered user of the Mega Sites, VV has 
uploaded approximately 16,950 files to Megavideo.com and Megaupload.com . which generated 
more than 34 million views. VV's uploads included many infringing copies of copyrighted 
motion pictures, including Ocean's Thirteen, Ratatouille, and Evan Almighty. Repeat infringer 
W last uploaded a file to a Mega Site on or about January 7, 2012. 

vv. On or about July 1 , 2008, DOTCOM sent an e-mail to ORTMANN 
entitled "[Fwd: Illegal links]". DOTCOM instructed him: "Never delete files from private 
requests like this. I hope your current automated process catches such cases." 

ww. On or about July 9, 2008, VAN DER KOLK sent an e-mail to a third- 
party, entitled "funny chat-log." In the e-mail, VAN DER KOLK copied the text of a previous 
online conversation between himself and ORTMANN, in which VAN DER KOLK had stated, 
"we have a funny business . . . modern days pirates :)" ORTMANN responded, "we're not 
pirates, we're just providing shipping services to pirates :)". 

4 As early as February 2008, the Mega Conspiracy had received notices from copyright holders 
indicating that there were at least 127 URL links to content uploaded by VV that was infringing 
and, after receiving the June 19, 2008 e-mail, the Mega Conspiracy received additional notices 
from copyright holders indicating that at least 107 URL links to content uploaded by VV were 
infringing. 
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xx. On or about July 1 0, 2008, an e-mail was sent from the 
"megsupp@googlemail.com On Behalf Of Megaupload Support" to a representative of a 
copyright holder falsely representing that the use of the Abuse Tool would "take down illegal 
content in real time." 

yy. On or about July 1 8, 2008, DOTCOM sent an e-mail message to 
ORTMANN instructing him to list "Mega Manager" as the "Number 1 dowload" out of the Top 
100 Megaupload.com files. 

zz. On or about August 4, 2008, the Mega Conspiracy launched their own 
advertising company for the Mega Sites called Megaclick.com . 

aaa. On or about August 11,2008, DOTCOM requested that the Mega 
Conspiracy's contract with Leaseweb drop a standard clause requiring contract termination for 
violations of Leaseweb's "Acceptable Use Policy." 

bbb. On or about September 1 , 2008, VAN DER KOLK uploaded an infringing 
copy of the copyrighted television program entitled 

"BBC.Earth.-.The.Power.Of.The.Planet.5of5.Rare.Earth.XviD.AC3.MVGroup.org.avi" to 
Megaupload.com and e-mailed the URL file to another individual. An infringing copy of this 
copyrighted work was still present on servers leased by the Mega Conspiracy as of 
September 8,2011. 

ccc. On or about October 3, 2009, DOTCOM sent an e-mail entitled 
"[Fwd: Re: Reporter hoping to speak about copyrighted content on Megavideo]" to an employee 
and to ORTMANN containing a series of statements purportedly from "[BL], Public Relations, 
Mega HQ" to a reporter for Forbes.com . In DOTCOM'S original e-mail to his employee, he 
informs her that "I used your name in the emails below. I hope you don't mind. Please be 
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careful. The larger we get the more people want to know more about Mega. Lets stay below the 
radar." The Forbes.com reporter had asked about KM SCHMITZ and TIM VESTOR's role in 
the company. DOTCOM wrote in response "I can confirm that nobody by the name of Kim 
Schmitz is associated with our company." DOTCOM further tells the reporter in a separate 
response, "We have a policy not to disclose details about our business performance. But I can 
tell you (off the record) that we are a small and humble business trying to earn enough to pay the 
bandwidth bill. Our site has grown to be popular but it is not easy to monetize the traffic in this 
economy." DOTCOM also indicates to the reporter in separate response, "The vast majority of 
users is uploading home videos, web cam captures, content they own or have the right to copy 
and other legitimate content." 

ddd. On or about October 13, 2008, BATATO sent an e-mail to an advertiser, 
which included a screen capture of the Megaupload.com download page for the file 
"MyBlueBerryNights.partl.rar". "My Blueberry Nights" is a copyrighted motion picture. The 
screen capture also contained an open browser window to the linking site www.mulinks.com . 

eee. On or about October 14, 2008, BATATO sent an e-mail to an advertiser 
that contained two Megaupload.com links. One of the links directed to a file 
"DanInRealLife.part2.rar", which was a portion of an infringing copy of the copyrighted motion 
picture "Dan in Real Life." 

fff. On or about October 25, 2008, VAN DER KOLK uploaded an infringing 
copy of a copyrighted motion picture entitled "Taken 2008 DVDRip Repack [A Release Lounge 
H264 By Micky22].mp4" to Megaupload.com and e-mailed the URL link for the file to another 
individual. An infringing copy of this copyrighted work was still present as of October 27, 201 1, 
on a server in the Eastern District of Virginia controlled by the Mega Conspiracy. 
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ggg. On or about October 3 1 , 2008, DOTCOM forwarded an e-mail to 
ORTMANN from a customer entitled "Sharebee.com" and stating that "Sharebee.com have 
uploaded over lmillion files to megaupload in 2008." ORTMANN responded to DOTCOM that 
Sharebee.com was a "multifile hoster upload service." Sharebee.com allows the mass 
distribution of files to a number of file hosting and distribution services, including 
Megaupload.com , and creates clickable links to access that content from multiple sites. 

hhh. On or about November 1 7, 2008, DOTCOM forwarded an e-mail to 
ORTMANN from a customer that indicated "I just want to start of by saying that i love the site, 
but today i discovered something i would consider a flawd. I was watching a video of Myth 
Busters when i recived a message that said "You have watched 3079 minutes of video today"". 
ORTMANN responded to DOTCOM that this was the correct behavior of the service. 

iii. On Or about November 23, 2008, DOTCOM forwarded an e-mail to 
ORTMANN and ECHTERNACH from a non-premium customer that indicated "i guess we need 
to find a new hobby because watching pirated material via megavideo is now over-rated and 
ruined because of this video bandwidth limit." 

jjj. On or about November 23, 2008, DOTCOM received an e-mail from a 
Mega Site user entitled "video problems." The e-mail described, "I've been trying to watch 
Dexter episodes, but. . . the sound doesn't match up with the visual. . . I didn't choose to use your 
site, you seem to dominate episodes 6 and 7 of Dexter on alluc[.org, a linking site]." DOTCOM 
forwarded the e-mail to ORTMANN and wrote, "... on many forums people complain that our 
video / sound are not in sync. . . We need to solve this asap!" "Dexter" is a copyrighted 
television series on the premium cable channel Showtime. 
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kkk. On or about December 5, 2008, NOMM sent VAN DER KOLK an e-mail, 
which included a screenshot of NOMM' s account using Megavideo.com to watch an infringing 
episode of the copyrighted television show "Chuck." The episode in the image, Season 2 
Episode 9, initially aired on December 1, 2008, four days before the e-mail. 

111. On or about January 14, 2009, BATATO sent an e-mail message to a 
Megaupload.com advertiser saying "You can find your banner on the downloadpages of 
Megaupload.com. Just choose a link for example from this site: www.mulinks.com.. ." 

mmm. On or about March 3, 2009, DOTCOM sent an e-mail to a reporter 
indicating "Whenever a user uploads a new file it is checked against our database and if we 
already have the exact same file the upload completes instantly. This way a complete system 
backup into the cloud only takes a fraction of the time it used to take. And the longer we exist, 
the more files we receive, the faster we get." 

nnn. On or about April 23, 2009, DOTCOM sent an e-mail message to VAN 
DER KOLK, ORTMANN, and BENCKO in which he complained about the deletion of URL 
links in response to infringement notices from the copyright holders. In the message, DOTCOM 
stated that "I told you many times not to delete links that are reported in batches of thousands 
from insignificant sources. I would say that those infringement reports from MEXICO of 
"14,000" links would fall into that category. And the fact that we lost significant revenue 
because of it justifies my reaction." 

ooo. On or about April 24, 2009, DOTCOM sent an e-mail to BENCKO, 
ORTMANN, and VAN DER KOLK indicating, "I remembered the steep drop of revenue at the 
same time in 2008 and thought that this might have also been caused by careless mass link 
deletions. This made me very mad, especially because I told you that such mass deletions should 
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be prevented and sources checked much more carefully. I am sure such mass link deletions are 
also contributing to a drop of revenue ... In the future please do not delete thousands of links at 
ones from a single source unless it comes from a major organization in the US." 

ppp. Starting as early as April 29, 2009, a member of the Mega Conspiracy 
made multiple transfers in and affecting interstate and foreign commerce through PayPal, Inc. to 
NA, a resident of Alexandria, Virginia, which is in the Eastern District of Virginia, as part of the 
Mega Conspiracy's "Uploader Rewards" program. NA received total payments from the 
Conspiracy of $600, including transfers of $100 on April 29, 2009; $100 on May 25, 2009; and 
$400 on July 31, 2009. 

qqq. Starting as early as April 29, 2009, a member of the Mega Conspiracy 
made multiple transfers in and affecting interstate and foreign commerce through PayPal, Inc. to 
NS, a resident of Fairfax, Virginia, which is in the Eastern District of Virginia, as part of the 
Mega Conspiracy's "Uploader Rewards" program. NS received total payments from the 
Conspiracy of $300, including transfers of $100 on April 29, 2009; $100 on April 26, 2010; and 
$100 on May 8, 2010. 

rrr. On or about May 7, 2009, ORTMANN sent an e-mail in German to 
DOTCOM indicating the top referring or linking sites to Megaupload.com by Megaupload 
premium users. The linking sites included: seriesvonkis.com. surfthechannel.com . 
sharebee.com, taringa.net . watch-movies-links.net. cinetube.es . and megauploadforum.net . 

sss. On or about May 17, 2009, NOMM sent an e-mail to ORTMANN entitled 
"Competitor Links Report." The e-mail indicated that the top third-party sites used to reach 
Megavideo.com content were seriesvonkis.com , peliculasvonkis.com . dospuntocerovision.com . 
cinetube.es , and surfthechannel .com , which are all linking sites. 
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ttt. On or about May 25, 2009, NOMM sent an e-mail to DOTCOM and 
ORTMANN entitled "status report." NOMM wrote "I have been processing HD videos for 
some time now to find best of the best for showcase (Mathias gave specification). Even though 
we have lots of HD content uploaded most seems to be problematic quality or legality wise." 

uuu. On or about May 25, 2009, BATATO sent an e-mail to ORTMANN that 
contained customers' e-mails. One of the customer e-mails indicated: "We watched Taken 
successfully and then tried to watch the "Alphabet Killer" a day later and got the message to 
upgrade if we wanted to continue watching." "Taken" and "The Alphabet Killer" are 
copyrighted motion pictures. 

vw. On or about June 6, 2009, BATATO sent an e-mail to an advertiser 
indicating, "Banners will be shown on the download pages of Megaupload. You will find some 
links here for example: http://mulinks.com/news.php". 

www. Starting as early as July 3 1 , 2009, a member of the Mega Conspiracy 
made multiple transfers in and affecting interstate and foreign commerce through PayPal, Inc. to 
TT, a resident of Woodbridge, Virginia, which is in the Eastern District of Virginia, as part of the 
Mega Conspiracy's "Uploader Rewards" program. TT received total payments from the 
Conspiracy of $2,700, including transfers totaling $100 on July 31, 2009; $100 on August 29, 
2009; $200 on September 18, 2009; $100 on September 29, 2009; $200 on October 8, 2009; 
$200 on November 8, 2009; $600 on November 24, 2009; $1,000 on December 23, 2009; and 
$200 on February 1,2010. 

xxx. Starting as early as August 9, 2009, a member of the Mega Conspiracy 
made multiple transfers in and affecting interstate and foreign commerce through PayPal, Inc. to 
CW, a resident of Moseley, Virginia, which is in the Eastern District of Virginia, as part of the 
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Mega Conspiracy's "Uploader Rewards" program. CW received total payments from the 
Conspiracy of $2,900, including payments of $100 and $600 on August 9, 2009; a payment of 
$500 on October 8, 2009; a transfer of $1,500 on December 23, 2009; and a payment of $200 on 
June 21, 2010. 

yyy. On or about August 1 0, 2009, TT of Woodbridge, Virginia, which is in the 
Eastern District of Virginia, sent a payment of $9.99 that traveled in interstate and foreign 
commerce through PayPal, Inc., and was received by the Megaupload.com PayPal, Inc. account. 

zzz. On or about September 4, 2009, a representative of Warner Brothers 
Entertainment, Inc. ("Warner") sent an e-mail to Megaupload.com , stating that Warner was 
"unable to remove links" to copyright-infringing content on Megaupload.com using the Abuse 
Tool. In the e-mail, the Warner representative requested an increase in Warner's removal limit, 
which is controlled by the Mega Conspiracy. On or about September 8, the representative sent a 
follow-up request, and on or about September 9, the representative sent another follow-up 
request. On or about September 10, ORTMANN sent an e-mail to DOTCOM, stating, "They are 
currently removing 2500 files per day - a cursory check indicates that it's legit takedowns of 
content that they own appearing in public forums." ORTMANN also stated, "We should comply 
with their request - we can afford to be cooperative at current growth levels." DOTCOM 
responded that the limit should be increased to 5,000 per day, but "not unlimited." 

aaaa. On or about September 29, 2009, CB of Alexandria, Virginia, which is in 
the Eastern District of Virginia, sent a payment of $9.99 that traveled in interstate and foreign 
commerce through PayPal, Inc., and was received by the Megaupload.com PayPal, Inc. account. 

bbbb. On or about October 25, 2009, VAN DER KOLK instructed a Mega 
Conspiracy employee through an e-mail, written in Dutch, how to alter the "featured" videos list 
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on Megavideo.com and the "Top 100" list on Megaupload.com . VAN DER KOLK wrote, 
among other things, that the Top 100 should only contain non-copyrighted files, such as game 
demos, software demos, and movie trailers. VAN DER KOLK instructed the employee to track 
what was currently popular on the Internet and to download material from websites such as 
download.com , apple.com/trailers . and gamespot.com . VAN DER KOLK further instructed the 
employee to create fake accounts on Megaupload.com and Megavideo.com and to upload the 
files to those accounts, so that it would appear that the files were uploaded by active users 
instead of Mega Conspiracy employees. 

cccc. On or about November 30, 2009, BATATO sent an e-mail to an advertiser 
stating: "Please go to mulinks.com and copy paste One of those URLs to your browser. You will 
then See where the banner appears." 

dddd. On or about January 28, 2010, in an e-mail entitled "activating old 
countries," a user of a Mega Conspiracy site asked BATATO: "where can we see full movies?" 
BATATO replied "You need to go to our referrer sites. Such as www.thepiratecitv.org or 
www.ovguide.com |".] There are the movie and series links. You cannot find them by searching 
on MV directly. That would cause us a lot of trouble ;-)" 

eeee. On or about February 1, 2010, BATATO sent an e-mail to an unindicted 
co-conspirator with the subject "[tradeit] - Campaign stats" stating "We can't deliver [Hong 
Kong] traffic because the company is based in [Hong Kong] and we don't want to experience 
any trouble with license holders etc. Remember, I told you about that topic ;-)". 

ffff. On or about March 15, 2010, a member of the Mega Conspiracy created 
Megastuff Limited, a New Zealand company, that has facilitated the transfer to New Zealand of 
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millions of dollars in illicit proceeds and assets for the personal financial gain of DOTCOM and 
other conspirators, as well as to facilitate additional operations of the Mega Conspiracy. 

gggg. On or about May 8, 20 1 0, NS of Fairfax, Virginia, which is in the Eastern 
District of Virginia, sent a payment of $199.99 that traveled in interstate and foreign commerce 
through PayPal, Inc., and was received by the Megaupload.com PayPal, Inc. account. 

hhhli. On or about June 24, 201 0, members of the Mega Conspiracy were 
informed, pursuant to a criminal search warrant from the U.S. District Court for the Eastern 
District of Virginia, that thirty-nine infringing copies of copyrighted motion pictures were 
believed to be present on their leased servers at Carpathia Hosting in Ashburn, Virginia. On or 
about June 29, 2010, after receiving a copy of the criminal search warrant, ORTMANN sent an 
e-mail entitled "Re: Search Warrant - Urgent" to DOTCOM and three representatives of 
Carpathia Hosting in the Eastern District of Virginia. In the e-mail, ORTMANN stated, "The 
user/payment credentials supplied in the warrant identify seven Mega user accounts", and further 
that "The 39 supplied MD5 hashes identify mostly very popular files that have been uploaded by 
over 2000 different users so far[.]" The Mega Conspiracy has continued to store copies of at 
least thirty-six of the thirty-nine motion pictures on its servers after the Mega Conspiracy was 
informed of the infringing content. 

iiii. On or about July 8, 2010, DOTCOM sent an e-mail to ORTMANN and 
ECHTERNACH entitled "attention." The e-mail contained a link to a news article entitled 
"Pirate Bay and Megaupload Escape Domain Seizure by US." The article discussed how, "[a]s 
part of an initiative to crack down on Internet piracy and counterfeiting, the US Government 
recently took action against sites making available movies and TV shows." In the e-mail, 
DOTCOM stated, "this is a serious threat to our business. Please look into this and see how we 
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can protect ourselfs." DOTCOM also asked, "Should we move our domain to another country 
(canada or even HK?)" ECHTERNACH responded, "In case domains are being seized from the 
registrar, it would be safer to choose a non-US registrar [.]" 

jjjj . On or about September 5, 20 1 0, BENCKO sent an e-mail to DOTCOM, 
ORTMANN, and VAN DER KOLK. Attached to the e-mail message was a screenshot of 
BENCKO logged into a Megaupload.com file download page with a filename of 
"Meet.Dave.2008.avi". "Meet Dave" is a copyrighted motion picture. 

kkkk. On or about November 1, 2010, ECHTERNACH forwarded an e-mail 
from a Universal Music Group ("UMG") executive to DOTCOM and ORTMANN, which 
discussed requirements that UMG would require of Megaupload before they could discuss 
licensing for MegaBox. Included in the list of requirements was "proactive fingerprint filtering 
to ensure that there is no infringing music content hosted on its service; proactive text filtering 
for pre-release titles that may not appear in fingerprint databases at an early stage; terminate the 
accounts of users that repeatedly infringe copyright; limit the number of possible downloads 
from each file; process right holder take down notices faster and more efficiently." 

1111. On or about November 15,2010, BATATO forwarded an e-mail to 
ORTMANN entitled "member-issue" that was received by a Mega Conspiracy employee from a 
user. In the forward, BATATO wrote "Fanpost ;-)". The e-mail from the user stated "I paid 
yesturday however can't work it out! ! !\ I have been trying to see Robin Hod, 3th season, chapter 
10, and do not succeed. Please help me solve it - or cancel my payment!" "Robin Hood" is a 
copyrighted television series that was originally released by the British Broadcasting 
Corporation. 
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mnimm. On or about November 23 , 20 1 0, members of the Mega 
Conspiracy caused a communication to be sent from a computer server in the Eastern District of 
Virginia to a representative of a copyright holder stating "1 file and 1 video removed from our 
system" in response to a takedown request that included a link to the 2010 version of the film "A 
Nightmare on Elm Street." 

nnnn. On or about December 10,201 0, DOTCOM forwarded a complaint from a 
user that "Megakey is not working" to ORTMANN and VAN DER KOLK. In the forward, 
DOTCOM writes "this doesn't work yet? we are advertising it. why is it not working?". In the 
user's e-mail, he complained that he installed Megakey, which provides Mega Conspiracy 
advertising to users in exchange for premium access to Megaupload.com and Megavideo.com . 
and the user was still receiving a message about the "megavideo time limit." The e-mail 
included apparent screenshots of the user's computer which shows the linking site animefreak.tv 
being used to attempt to watch an episode of the copyrighted television series "Fruits Basket" 
on Megavideo.com . 

oooo. On or about December 22, 20 1 0, ORTMANN provided DOTCOM with a 
possible response to a press inquiry that discusses the Recording Industry Association of 
America ("RIAA")'s campaign to have payment services such as Mastercard to stop allowing 
payments to Megaupload.com because the site is, in the words of the reporter citing RIAA, 
"dedicated to facilitating copyright infringement." ORTMANN' s proposed response includes: 
"We are watching the unfolding events with interest, but as the vast majority of our revenue is 
coming from advertising, the effect on our business will be limited." 

pppp. On or about January 13,2011, DOTCOM sent a proposed 
Megaupload.com public statement regarding piracy allegations against the website to hosting 
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company executives DS and JK. On or about January 13, 201 1, DS replied to DOTCOM: "It 
looks accurate to me. good luck." The same day, JK replied, "Using the words, '....vast 
majority is legitimate.' Opens you up. It's an admission that there are 'bad' things on your site. I 
would get rid of that so it simply reads that it is legitimate." 

qqqq. On or about January 27, 201 1 , ECHTERNACH forwarded an e-mail to 
VAN DER KOLK and BENCKO that an employee from the Megateam in the Philippines wrote 
that asked about access to Youtube. In that e-mail, the employee admits, "Even video resource 
sites such as Youtube which is our source for videos which we upload to Megavideo." 

rrrr. On or about February 2, 20 1 1 , DOTCOM forwarded an article from 
The Telegraph by e-mail to ORTMANN, which discusses the potential for courts in the 
United Kingdom to block access to "websites used exclusively for facilitating illegal 
downloading of content." 

ssss. On or about February 5, 201 1 , ORTMANN responded in an e-mail to 
DOTCOM, copying ECHTERNACH and VAN DER KOLK, about an article that DOTCOM 
sent him entitled "how-to-stop-domain-names-being-seized-by-the-us-government." 
ORTMANN indicates the status of the Mega Conspiracy's completion of the recommendations 
made in the article. 

tttt. On or about February 10, 201 1, DOTCOM forwarded a complaint to 
ORTMANN from a Taiwanese broadband service provider about problems its users have had 
downloading from Megaupload.com . In the screenshots that are in the original e-mail 
complaint is what appears to be an ongoing download of a copyrighted "The Simpsons" episode 
from Fox Television entitled "Treehouse of Horror XIII." The e-mail traces the download 
from the provider's connection to Cogent Communications to the Mega Conspiracy's servers. 
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uuuu. On or about February 1 8, 201 1, DOTCOM forwarded an e-mail inquiry 
entitled '"Repeat Offender' Infringement Policy" to ORTMANN. In the original e-mail, a 
representative of a copyright holder indicates that Megaupload.com does not specify any "repeat 
offender or repeat infringer policy" in its Terms of Service. The representative points out that 
the "Safe Harbor" provision of the DMCA "requires that providers deal appropriately with repeat 
offenders" and asks for the termination of repeat offenders on Megaupload.com . 

ww. On or about February 25, 20 1 1 , B ATATO forwarded an e-mail to 
NOMM, copying ORTMANN, entitled "embedded ads not functioning correctly," from an 
individual complaining that the advertising click through rate ("CTR") from playing 
Megavideo.com videos directly on the linking site alluc.org has suffered because the embedded 
advertising from the Mega Conspiracy is not automatically playing on the external website. The 
individual's e-mail contains screenshots from the linking site that shows episodes of the BBC 
copyrighted television show Red Dwarf that were available on Megavideo.com . B ATATO, in 
the forward, stated: "Could you please check that issue? We need to help them a bit now as their 
CTR and conversions went down by 50% and 95% respectively. That was expected but at least 
we should help them now get their campaigns running w/o problems." 

wwww. On or about February 25, 201 1 , B ATATO sent an e-mail to 
NOMM and VAN DER KOLK regarding problems with getting "pre-roll" advertising for 
Megavideo.com because of a "copy right issue." His e-mail contains messages between 
employees of Megaclick.com and a third-party advertising service. In an early message, the 
Megaclick.com employee informs BATATO that the third-party advertising service considers it 
illegal to monetize infringing content through advertising immediately prior to viewing the 
content. 
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xxxx. On or about March 9, 20 1 1 , a developer for the Mega Conspiracy sent an 
e-mail to ORTMANN and two other individuals. In the e-mail, the developer indicated that an 
associate had downloaded an infringing copy of a copyrighted musical recording entitled 
"The_Matrix_-_Original_Motion_Picture_Score.rar" from Rapidshare.com . and then, using the 
"Megakey music search," added the files to a Megabox account. The e-mail further indicates 
that the Megabox website listed the wrong artist for the album. 

yyyy. On or about March 9, 20 1 1 , members of the Mega Conspiracy caused a 
communication to be sent from a computer server in the Eastern District of Virginia to a 
representative of a copyright holder stating "2 files removed from our system" in response to 
a takedown request that included links to the 2009 version of the film "Friday the 13th" (in 
two parts). 

zzzz. On or about March 1 1 , 201 1 , members of the Mega Conspiracy caused a 
communication to be sent from a computer server in the Eastern District of Virginia to a 
representative of a copyright holder stating "2 files removed from our system" in response to a 
takedown request that included links to copies of episodes of the copyrighted television show 
"Modern Family." 

aaaaa. On or about April 29, 201 1 , members of the Conspiracy infringed the 
copyright of the motion picture "The Green Hornet" by making it available on publicly 
accessible Internet-connected servers at Carpathia Hosting in Ashburn, Virginia, within the 
Eastern District of Virginia, and reproduced and distributed the work over the Internet without 
authorization. The film, which had been released in U.S. theaters on or about January 14, 201 1, 
was not commercially distributed in the United States until on or about May 3, 201 1. 
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bbbbb. On or about April 30, 201 1, members of the Mega Conspiracy caused a 
communication to be sent from a computer server in the Eastern District of Virginia to a 
representative of a copyright holder in response to a takedown request that included a link to the 
film "Fast Five." 

ccccc. On or about May 13, 201 1, members of the Conspiracy infringed the 
copyright of the motion picture "Thor" by making it available on publicly accessible Internet- 
connected servers at Carpathia Hosting in Ashburn, Virginia, within the Eastern District of 
Virginia, and reproduced and distributed the work over the Internet without authorization. The 
film, which had been released in U.S. theaters on or about May 6, 201 1, was not commercially 
distributed in the United States until on or about September 13, 201 1 . 

ddddd. On or about May 13, 201 1, an e-mail was sent from the "Megaupload 
Abuse Desk" to a representative of a copyright holder falsely representing that the use of the 
Abuse Tool would "take down material from Megavideo." 

eeeee. On or about June 7, 201 1 , VAN DER KOLK sent an e-mail to 
ORTMANN forwarding a French complaint about infringement of their copyrighted motion 
pictures. In the forward, VAN DER KOLK stated: "They basically want us to audit / filter every 
upload, and are threatening with action against us if their material continues to appear on MV." 

fffff. On or about July 6, 201 1 , DOTCOM forwarded an online story from 
Spiegel.tv to ORTMANN about the takedown of the linking site Kino.to by law enforcement in 
Germany, and wrote, in German: "Possibly not fly to Germany?" 

ggggg. On or about July 6, 201 1, BATATO sent an e-mail to ORTMANN 
forwarding a string of e-mails in German from an advertising entity saying that a customer wants 
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their campaigns on a Mega Site discontinued because of concerns related to the Kino .to 
takedown. 

hhhhh. On or about August 10, 201 1, members of the Mega Conspiracy caused a 
communication to be sent from a computer server in the Eastern District of Virginia to a 
representative of a copyright holder stating "6 files and 6 videos removed from our system" in 
response to a takedown request that included links to the 2010 version of the copyrighted motion 
picture "A Nightmare on Elm Street." 

iiiii. On or about August 1 1 , 20 1 1 , DOTCOM forwarded an e-mail to 
ORTMANN from a user who stated: "I used to buy monthly fees to help with the cost of you 
guys doing business .... I miss being about to view tv shows on you service . My most favorite 
was True blood and battle star Gallactica . I would be happy to continue to pay for the service , 
but some thing would needs to change. I don't mind your services be bogged down from time to 
time. I don't mind paying, but i need to get something for the service i pay for." 

jjjjj . On or about August 12,2011, members of the Conspiracy infringed the 
copyright of the motion picture "Bad Teacher" by making it available on publicly accessible 
Internet-connected servers at Carpathia Hosting in Ashburn, Virginia, within the Eastern District 
of Virginia, and reproduced and distributed the work over the Internet without authorization. 
The film, which had been released in U.S. theaters on or about June 24, 201 1, was not 
commercially distributed in the United States until on or about October 18, 201 1. 

kkkkk. On or about August 14, 201 1, members of the Conspiracy infringed the 
copyright of the motion picture "Harry Potter and the Deathly Hallows, Part 1" by distribution 
without authorization. 
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11111. On or about September 16,2011, NOMM sent an analysis of 
Megavideo.com to ORTMANN by e-mail. The analysis indicates: "The search function for the 
site should also list full length videos. Currently, movies that do not have copyright 
infringements are also not being listed in the search." The analysis further indicates: "Movies 
should also be available in Megavideo and not from third party websites only[.]" 

mmmmm. On or about September 1 7, 20 1 1 , VAN DER KOLK sent an e-mail 
to ORTMANN, attaching a Google Analytics report on referrals to Megaupload.com from the 
linking site Taringa.net . The single page report indicates that, between August 17, 2010 and 
September 16, 201 1, Taringa.net provided more than 72 million referrals to Megaupload.com . 
with the top 10 links including some copyrighted software and music titles. The page indicates, 
for example, that the linking site produced 164,214 visits to Megaupload.com for a free 
download of the copyrighted CD/DVD burning software package Nero Suite 10. Each of these 
visits generated advertising revenue for the Mega Conspiracy. Nero Suite 10 had a suggested 
retail price of $99. 

nnnnn. On or about October 10, 201 1, JK, an executive from a hosting provider, 
sent an e-mail to ORTMANN entitled "Article." The e-mail contained a link to a news article, 
which discussed how a Dutch court ordered a "major" website "to delete all infringing content 
from its servers." The article asked: "Could file-hosting services like MegaUpload and 
RapidShare be next?" In the e-mail, JK asked ORTMANN: "Do you have any concerns that 
this kind of thing could find its way to you"? ORTMANN responded to JK, with a copy to 
DOTCOM, stating that the sites in the article "provide a search index covering their entire 
content base, including the infringing material." 
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ooooo. On or about October 14, 201 1, just approximately three months after 

ending the Mega Conspiracy's Uploader Rewards program that offered payments through 

Paypal, Inc. and other things of value to reward uploaders (including known and repeat 

infringers), DOTCOM sent an e-mail to a PayPal representative, stating: 

Our legal team in the US is currently preparing to sue some of our competitors and 
expose their criminal activity. We like to give you a heads up and advice you not to work 
with sites that are known to pay uploaders for pirated content. They are damaging the 
image and the existence of the file hosting industry (see whats happening with the Protect 
IP act). Look at Filesei-ve.com, Videobb.com, Filesonic.com, Wupload.com, 
Uploadstation.com. These sites pay everyone (no matter if the files are pirated or not) 
and have NO repeat infringer policy. And they are using PAYPAL to pay infringers. 

ppppp. On or about October 18, 201 1, VAN DER KOLK sent an e-mail to 
ORTMANN, forwarding a complaint from the Vietnamese Entertainment Content Protection 
Association. The complaint indicated that the DMCA Abuse Tool for Megaupload.com does not 
remove particular types of links. It also noted that a particular linking site is a repeat infringer 
"where users and admin team are all involved in upload and reupload as soon as the files are 
removed." It also stated "To date, we have removed 24 pages of infringed download links and 
almost 100% are Megaupload." 

qqqqq. On or about November 10, 201 1, a member of the Mega Conspiracy made 
a transfer of $185,000 to further an advertising campaign for Megaupload.com . involving a 
musical recording and video. 

rrrrr. On or about November 20, 20 1 1 , members of the Conspiracy infringed the 
copyright of a high definition version of the motion picture "Lord of the Rings: Fellowship of the 
Ring" by distribution without authorization. 

sssss. On or about November 20, 201 1 , members of the Conspiracy infringed the 
copyright of the motion picture "The Twilight Saga: Breaking Dawn - Part 1" by making it 
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available on publicly accessible Internet-connected servers at Carpathia Hosting in Ashbum, 
Virginia, within the Eastern District of Virginia, and reproduced and distributed the work over 
the Internet without authorization. The film, which was released in U.S. theaters on or about 
November 18, 201 1, had not been commercially distributed as of January 5, 2012. 

(All in violation of Title 18, United States Code, Section 371) 
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COUNT THREE 

(18 U.S.C. § 1956(h) - Conspiracy to Commit Money Laundering) 
THE GRAND JURY CHARGES THAT: 

74. The factual allegations in Paragraphs 1 through 45; 53 through 73; and 100 
through 104 are hereby re-alleged and incorporated as if set forth here in their entirety. 

75. Beginning in at least September 2005 and continuing until at least January 19, 
2012, in the Eastern District of Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINN BATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
each knowingly and intentionally combined, conspired, and agreed together and with each other, 
and with other persons known and unknown to the Grand Jury, to commit offenses against the 
United States in violation of Title 18, United States Code, Sections 1956 and 1957, namely: 
(a) to knowingly conduct and attempt to conduct a financial transaction 
affecting interstate and foreign commerce, which in fact involved the proceeds of the specified 
unlawful activities of criminal copyright infringement and wire fraud with the intent to promote 
the carrying on of the specified unlawful activities of criminal copyright infringement and wire 
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fraud, and that while conducting and attempting to conduct such financial transaction knew that 
the property involved in the financial transaction represented the proceeds of some form of 
unlawful activity in violation of Title 18, United States Code, Section 1956(a)(l)(A)(i); 

(b) to transport, transmit, and transfer and attempt to transport, transmit, and 
transfer a monetary instrument and funds from a place in the United States to and through a place 
outside the United States, and to a place in the United States from or through a place outside the 
United States, with the intent to promote the carrying on of the specified unlawful activities of 
criminal copyright infringement and wire fraud, in violation of Title 18, United States Code, 
Section 1956(a)(2)(A); and 

(c) to knowingly engage and attempt to engage in monetary transactions in 
criminally derived property of a value greater than $10,000 that is derived from the specified 
unlawful activities of criminal copyright infringement and wire fraud, in violation of Title 18, 
United States Code, Section 1957. 

Ways, Manner, and Means of the Conspiracy 
In furtherance of the Conspiracy, defendants and others known and unknown to the 
Grand Jury employed, among others, the following manner and means: 

76. It was part of the Conspiracy that members of the Conspiracy willfully 
reproduced and distributed, in the Eastern District of Virginia and elsewhere, infringing copies 
and phonorecords of copyrighted works with the purposes of commercial advantage and private 
financial gain; such conduct is a "specified unlawful activity" under Title 18 of the United States 
Code, Sections 1956(c)(1), (c)(7)(A), & (c)(7)(D). 

77. It was further part of the Conspiracy that members of the Conspiracy knowingly 
devised and intended to devise a scheme to defraud and to obtain money by means of materially 
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false and fraudulent pretenses, representations and promises; such conduct is a "specified 
unlawful activity" under Title 18 of the United States Code, Sections 1956(c)(1), (c)(7)(A), & 
(c)(7)(D). 

78. It was further part of the Conspiracy that infringing copies and phonorecords of 
copyrighted works were stored on computer servers controlled by the Conspiracy located at 
Carpathia Hosting in Ashburn, Virginia, which is in the Eastern District of Virginia; such 
conduct occurred at least in part in the United States, under Title 18 of the United States Code, 
Section 1956(f)(1). 

79. It was further part of the Conspiracy that a transaction or series of transactions 
conducted by members of the Conspiracy involved funds or monetary instruments of a value 
exceeding $10,000, under Title 18 of the United States Code, Section 1956(f)(2). 

80. It was further part of the Conspiracy that members of the Conspiracy intended to 
promote the carrying on of criminal copyright infringement and wire fraud using multiple 
financial transactions affecting interstate and foreign commerce, which involved the proceeds of 
criminal copyright infringement and wire fraud, and that, while conducting and attempting to 
conduct such financial transactions, members of the Conspiracy knew that the property involved 
in the transactions represented the proceeds of criminal copyright infringement and wire fraud. 

81. It was further part of the Conspiracy that members of the Conspiracy intended to 
promote the carrying on of criminal copyright infringement and wire fraud using multiple 
transfers involving monetary instruments and funds from places in the United States to and 
through places outside the United States, and to places in the United States from or through 
places outside the United States. 
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82. It was further part of the Conspiracy that members of the Conspiracy knowingly 
engaged in multiple monetary transactions in criminally derived property of a value greater than 
$10,000 that was derived from criminal copyright infringement and wire fraud. 

83 . It was further part of the Conspiracy that multiple transfers totaling more than 
$5 million, which involved proceeds of criminal copyright infringement and wire fraud in the 
Eastern District of Virginia and elsewhere, from a Moneybookers Limited account in the United 
Kingdom were made, and the transfers were directed to a DBS (Hong Kong) Limited account for 
the Conspiracy in Hong Kong between August 1, 2010 and July 31, 201 1; such activity provides 
jurisdiction under Title 18 of the United States Code, Section 1956(f). 

84. It was further part of the Conspiracy that multiple transfers totaling more than 
$66 million, which involved proceeds of criminal copyright infringement and wire fraud in the 
Eastern District of Virginia and elsewhere, from a PayPal, Inc. account were made in and 
affecting interstate and foreign commerce and by a member of the Conspiracy, and the transfers 
were directed to a DBS (Hong Kong) Limited account for the Conspiracy between on or about 
August 3, 2007, and July 31, 201 1; such activity provides jurisdiction under Title 18 of the 
United States Code, Section 1956(f). 

85. It was further part of the Conspiracy that multiple transfers totaling more than 
$6 million, which involved proceeds of criminal copyright infringement and wire fraud in the 
Eastern District of Virginia and elsewhere, from a PayPal, Inc. account for the Conspiracy were 
made in and affecting interstate and foreign commerce by a member of the Conspiracy, and the 
transfers were directed to a bank account in Hong Kong for the Conspiracy between on or about 
August 15, 2005, and July 5, 2010; such activity provides jurisdiction under Title 18 of the 
United States Code, Section 1956(f) and included the following: 
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a. On or about August 15, 2005, a transfer of approximately $14,750 to a 
HSBC Bank account for the Conspiracy; 

b. On or about September 23, 2008, transfers of approximately $320,150 to a 
DBS (Hong Kong) Limited account for the Conspiracy; 

c. On or about November 9, 2009, transfers of approximately $ 1 ,077,648 to 
a DBS (Hong Kong) Limited account for the Conspiracy; 

d. On or about December 2, 2009, transfers of approximately $667,443 to a 
DBS (Hong Kong) Limited account for the Conspiracy; and 

e. On or about July 5, 201 0, transfers of approximately $656,507 to a DBS 
(Hong Kong) Limited account for the Conspiracy. 

86. It was further part of the Conspiracy that multiple transfers, which involved 
proceeds of criminal copyright infringement and wire fraud in the Eastern District of Virginia 
and elsewhere, from a DBS (Hong Kong) Limited bank account for the Conspiracy were made 
by a member of the Conspiracy, and the transfers were directed to a ABN AMRO BANK NV 
account for Leaseweb in the Netherlands; such activity provides jurisdiction under Title 18 of the 
United States Code, Section 1956(f) and included the following: 

a. On or about May 5, 2009, a transfer of approximately $733,000; and 

b. On or about December 1 6, 2009, a transfer of approximately $800,000. 

87. It was further part of the Conspiracy that multiple transfers, which involved 
proceeds of criminal copyright infringement and wire fraud in the Eastern District of Virginia 
and elsewhere, from a DBS (Hong Kong) Limited bank account for the Conspiracy were made in 
and affecting interstate and foreign commerce by a member of the Conspiracy, and the transfers 
were directed to a PNC Bank NA account for Carpathia Hosting in Richmond, Virginia, which is 
in the Eastern District of Virginia, including the following: 

a. On or about December 20, 201 0, a transfer of approximately $720,000; 

b. On or about March 3 1 , 20 1 1 , a transfer of approximately $ 1 ,060,274; 
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c. On or about May 5, 201 1 , a transfer of approximately $950,000; 

d. On or about June 2, 201 1 , a transfer of approximately $950,000; and 

e. On or about July 5, 201 1 , a transfer of approximately $950,000. 

88. It was further part of the Conspiracy that multiple transfers, which involved 
proceeds of criminal copyright infringement and wire fraud in the Eastern District of Virginia 
and elsewhere, from a DBS (Hong Kong) Limited bank account for the Conspiracy were made in 
and affecting interstate and foreign commerce by a member of the Conspiracy, and the transfers 
were directed to a Suntrust Bank account for Cogent Communications in Atlanta, Georgia, 
including the following: 



a. 


On or 


b. 


On or 


c. 


On or 


d. 


On or 


e. 


On or 


f. 


On or 


g. 


On or 


h. 


On or 


i. 


On or 


j- 


On or 


k. 


On or 


1. 


On or 


m. 


On or 


n. 


On or 
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0. 


On or 


p. 


On or 


q- 


On or 


r. 


On or 


s. 


On or 


t. 


On or 


u. 


On or 


V. 


On or 


w. 


On or 


X. 


On or 


y. 


On or 


z. 


On or 


aa. 


On or 


bb. 


On or 


cc. 


On or 


dd. 


On or 



89. It was further part of the Conspiracy that multiple transfers, which involved 
proceeds of criminal copyright infringement and wire fraud in the Eastern District of Virginia 
and elsewhere, from the PayPal, Inc. account for the Conspiracy in Hong Kong were made in 
and affecting interstate and foreign commerce by a member of the Conspiracy to the benefit of 
Carpathia Hosting in Ashburn, Virginia, which is in the Eastern District of Virginia, including 
the following: 
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a. On or about October 7, 2008, transfers totaling approximately $90,000 to 
WR, the Chief Financial Officer of Carpathia Hosting; 

b. On or about May 30, 20 1 0, transfers totaling approximately $688,852 to 
WR, the Chief Financial Officer of Carpathia Hosting; and 

c. On or about July 2, 2010, transfers totaling approximately $688,852 to 
WR, the Chief Financial Officer of Carpathia Hosting. 

90. It was further part of the Conspiracy that multiple transfers, which involved 

proceeds of criminal copyright infringement and wire fraud in the Eastern District of Virginia 

and elsewhere, from the PayPal, Inc. account for the Conspiracy were made in and affecting 

interstate and foreign commerce by a member of the Conspiracy to the benefit of individuals in 

the Eastern District of Virginia in order to promote criminal copyright infringement and wire 

fraud, including the following: 

a. On September 29, 2007, and March 1 1 , 2009, a member(s) of the 
Conspiracy made transfers of $1,500 (totaling $3,000) to PA, a resident of 
Newport News, Virginia, which is in the Eastern District of Virginia; 

b. Starting as early as January 27, 2008, multiple transfers to CB, a resident 
of Alexandria, Virginia, which is in the Eastern District of Virginia. A 
member(s) of the Conspiracy transferred a total of $500 to CB, including 
transfers of $100 on January 27, 2008; $300 on October 8, 2009; and $100 
on February 1,2010; 

c. Starting as early as February 11, 2008, multiple transfers to ND, a resident 
of Falls Church, Virginia, which is in the Eastern District of Virginia. A 
member(s) of the Conspiracy transferred a total of $900 to ND, including 
transfers of $100 on February 11, 2008; $100 on March 3, 2008; $300 on 
March 15, 2008; $100 on March 29, 2008; and $300 on April 15, 2008; 

d. Starting as early as April 29, 2009, multiple transfers to NA, a resident of 
Alexandria, Virginia, which is in the Eastern District of Virginia. A 
member(s) of the Conspiracy transferred a total of $600 to NA, including 
transfers of $100 on April 29, 2009; $100 on May 25, 2009; and $400 on 
July 31, 2009; 

e. Starting as early as April 29, 2009, multiple transfers to NS, a resident of 
Fairfax, Virginia, which is in the Eastern District of Virginia. A 
member(s) of the Conspiracy transferred a total of $300 to NS, including 
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transfers of $100 on April 29, 2009; $100 on April 26, 2010; and $100 on 
May 8, 2010; 

f. Starting as early as July 3 1 , 2009, multiple transfers to TT, a resident of 
Woodbridge, Virginia, which is in the Eastern District of Virginia. A 
member(s) of the Conspiracy transferred a total of $2,700 to TT, including 
transfers of $100 on July 31, 2009; $100 on August 9, 2009; $100 on 
September 2, 2009; $200 on September 18, 2009; $200 on October 8, 
2009; $200 on November 8, 2009; $600 on November 24, 2009; $1,000 
on December 23, 2009; and $200 on February 1, 2010; and 

g. Starting as early as August 9, 2009, multiple transfers to CW, a resident of 
Moseley, Virginia, which is in the Eastern District of Virginia. A 
member(s) of the Conspiracy transferred a total of $2,900 to CW, 
including transfers of $100 and $600 on August 9, 2009; a payment of 
$500 on October 8, 2009; a transfer of $1,500 on December 23, 2009; and 
a payment of $200 on June 21,2010. 

91. It was further part of the Conspiracy that multiple transfers, which involved 
proceeds of copyright infringement and wire fraud in the Eastern District of Virginia and 
elsewhere, were made by the Conspiracy for yacht rentals in the Mediterranean Sea, for the 
purpose of promoting criminal copyright infringement and wire fraud, including the following: 

a. On or about April 8, 20 1 1 , VESTOR LIMITED transferred approximately 
$6 1 6,000 to NBS for yacht rental; 

b. On or about April 1 8, 20 1 1 , VESTOR LIMITED transferred 
approximately $3,606,000 to ECL for yacht rental; 

c. On or about May 27, 2011, MEGAUPLO AD LIMITED transferred 
approximately $212,000 to ECL for yacht rental; 

d. On or about June 22, 201 1, VESTOR LIMITED transferred approximately 
$1,127,000 to NBS for yacht rental; and 

e. On or about June 24, 20 1 1 , VESTOR LIMITED transferred approximately 
$2,394,000 to S YM for yacht rental. 

92. It was further part of the Conspiracy that on or about November 1 0, 20 1 1 , a 



member of the Conspiracy made transfers of $185,000, for the purpose of promoting criminal 
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copyright infringement and wire fraud, associated with an advertising campaign for 
Megaupload.com . 



(All in violation of Title 18, United States Code, Section 1956(h)) 
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COUNT FOUR 

(18 U.S.C. §§ 2, 2319; 17 U.S.C. § 506 - 
Criminal Copyright Infringement by Distributing a Copyrighted Work 
Being Prepared For Commercial Distribution on a Computer Network 
& Aiding and Abetting Criminal Copyright Infringement) 

THE GRAND JURY CHARGES THAT: 

93 . On or about October 25, 2008, in the Eastern District of Virginia and elsewhere, 

the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINNBATATO, 
JULIUS BENCKO, 
SVENECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM,and 
BRAM VAN DER KOLK 
did willfully, and for purposes of commercial advantage and private financial gain, infringe a 
copyright by distributing a work being prepared for commercial distribution in the United States, 
to wit, the copyrighted motion picture "Taken" (which would not be commercially distributed 
until on or about January 30, 2009) by making it available on a computer network accessible to 
members of the public, when defendants knew, and should have known, that the work was 
intended for commercial distribution. 

(All in violation of Title 17, United States Code, Section 506(a)(1)(C) and Title 18, United States 
Code, Sections 2 & 23 19(d)(2)) 



72 



Case 1:1 2-cr-00003-LO Document34 Filed 02/16/12 Page 73 of 90 PagelD# 318 



COUNT FIVE 

(18 U.S.C. §§ 2, 2319; 17 U.S.C. § 506 - 
Criminal Copyright Infringement By Electronic Means 
& Aiding and Abetting Criminal Copyright Infringement) 

THE GRAND JURY CHARGES THAT: 

94. For the 1 80 days up to and including January 19, 2012, in the Eastern District of 

Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINNBATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
did willfully, and for purposes of commercial advantage and private financial gain, infringe 
copyrights in certain motion pictures, television programs, musical recordings, electronic books, 
images, video games, and other computer software, by reproducing and distributing over the 
Internet, during a 180-day period, at least ten copies and phonorecords of one or more 
copyrighted works which had a total retail value of more than $2,500. 

(All in violation of Title 17, United States Code, Section 506(a)(1)(A) and Title 18, United States 
Code, Section 2319(b)(1)) 
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COUNT SIX 

(18 U.S.C. §§ 2, 2319; 17 U.S.C. § 506 - 
Criminal Copyright Infringement By Electronic Means 
& Aiding and Abetting Criminal Copyright Infringement) 

THE GRAND JURY CHARGES THAT: 

95 . For the 1 80 days up to and including August 3 1 , 20 1 0, in the Eastern District of 

Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINNBATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
did willfully, and for purposes of commercial advantage and private financial gain, infringe 
copyrights in certain motion pictures, television programs, musical recordings, electronic books, 
images, video games, and other computer software, by reproducing and distributing over the 
Internet, during a 180-day period, at least ten copies and phonorecords of one or more 
copyrighted works which had a total retail value of more than $2,500. 

(All in violation of Title 17, United States Code, Section 506(a)(1)(A) and Title 18, United States 
Code, Section 2319(b)(1)) 
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COUNT SEVEN 

(18 U.S.C. §§ 2, 2319; 17 U.S.C. § 506 - 
Criminal Copyright Infringement By Electronic Means 
& Aiding and Abetting Criminal Copyright Infringement) 

THE GRAND JURY CHARGES THAT: 

96. For the 1 80 days up to and including August 1 6, 2008, in the Eastern District of 

Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINNBATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM,and 
BRAM VAN DER KOLK 
did willfully, and for purposes of commercial advantage and private financial gain, infringe 
copyrights in certain motion pictures, television programs, musical recordings, electronic books, 
images, video games, and other computer software, by reproducing and distributing over the 
Internet, during a 180-day period, at least ten copies and phonorecords of one or more 
copyrighted works which had a total retail value of more than $2,500. 

(All in violation of Title 17, United States Code, Section 506(a)(1)(A) and Title 18, United States 
Code, Section 23 19(b)(1)) 
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COUNT EIGHT 

(18 U.S.C. §§ 2, 2319; 17 U.S.C. § 506 - 
Criminal Copyright Infringement By Electronic Means 
& Aiding and Abetting Criminal Copyright Infringement) 

THE GRAND JURY CHARGES THAT: 

97. For the 1 80 days up to and including October 3 1 , 2007, in the Eastern District of 

Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINN BATATO, 
JULIUS BENCKO, 
SVENECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
did willfully, and for purposes of commercial advantage and private financial gain, infringe 
copyrights from the Youtube.com platform, by reproducing and distributing by electronic means, 
during a 180-day period, at least ten copies and phonorecords of one or more copyrighted works 
which had a total retail value of more than $2,500. 



(All in violation of Title 17, United States Code, Section 506(a)(1)(A) and Title 18, United States 
Code, Section 23 19(b)(1)) 
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COUNTS NINE THROUGH THIRTEEN 

(18U.S.C. §§ 2 and 1343- 
Fraud by Wire & Aiding and Abetting Fraud by Wire) 

THE GRAND JURY CHARGES THAT: 

98. The factual allegations in paragraphs 1 through 45 and 53 through 73 are re- 
alleged and incorporated as if set forth here in their entirety. 

99. Beginning in at least September 2005 and continuing until January 19, 2012, in 
the Eastern District of Virginia and elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINN BATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
BRAM VAN DER KOLK 
knowingly devised and intended to devise a scheme to defraud and to obtain money by means of 
materially false and fraudulent pretenses, representations and promises. 

100. It was part of the scheme that the defendants and others would mislead copyright 
holders into believing that their notifications of infringing copies of copyrighted works would 
result in the removal of the file or that access to the file would be disabled, when in fact, at best, 
only the link(s) identified by the copyright holder would be disabled. 
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101. The scheme allowed infringing copies of copyrighted works to remain on the 
servers controlled by the Mega Conspiracy and accessible to members of the public (as long as at 
least one link remained unknown to the copyright holder providing the notification), and would 
further allow new links to the infringing copy to be created (even though the infringing copy had 
already been identified as infringing by the copyright holder). 

1 02. It was further part of the scheme that the defendants and others would represent to 
copyright holders and others that repeat copyright infringers would have their user access 
terminated pursuant to terms of service announced by the Mega Conspiracy, when, in fact, repeat 
infringers were allowed to continue their infringement and at times even rewarded financially 
for it. 

1 03 . It was further part of the scheme that the Mega Conspiracy obtained advertising 
revenue as a result of the continued availability of files known to be infringing when members of 
the public were able to view and download them, and provided additional incentive for users to 
purchase premium subscriptions due to continuous access to infringing copies of copyrighted 
works. 

104. It was further part of the scheme to defraud that the defendants and others 
misrepresented the Mega Conspiracy's Abuse Tool and notice-and-takedown procedure in 
various e-mails to copyright holders and others as follows: 

a. That notification through the Abuse Tool would "remove a batch of files 
from [Mega's] servers;" 

b. That the takedown process enabled the copyright holders to "take down 
illegal content in real time;" 
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c! That the Mega Conspiracy would be "talcing great care in expeditiously 
deleting any material reported to [them] through DMCA takedown 
notices;" 

d. That the "takedown tool" would "remove" videos and/or files "from our 
system immediately;" 

e. That the Abuse Tool granted copyright holders "direct deletion rights," 
which allowed the rights holders to "take files and films offline 
immediately." 

f. That Megavideo was "one of the few online video communities that 
ma[de] it impossible to fraudulently host full-length feature movies due to 
a human-assisted automatic detection/deletion mechanism." 

g. That identifying a URL link to infringing material though the Abuse Tool 
would "take down material from Megavideo." 

105. On or about the dates listed below, in the Eastern District of Virginia and 
elsewhere, the defendants, 

KIM DOTCOM, 
MEGAUPLOAD LIMITED, 
VESTOR LIMITED, 

FINN BATATO, 
JULIUS BENCKO, 
SVEN ECHTERNACH, 
MATHIAS ORTMANN, 
ANDRUS NOMM, and 
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BRAM VAN DER KOLK 

for the purpose of executing the aforesaid scheme and artifice to defraud and to obtain money 
and property by means of materially false and fraudulent pretenses, representation and promises, 
knowingly transmitted and caused to be transmitted, in interstate and foreign commerce, the 



following described wire communications, including writings, signs, and signals: 



COUNT 


APPROXIM ATF DATF 

rVJT X XV Vf VYJ.lV.LrV J. Hi \J r\. X Hi 




Nine 


November 23,2010 


A communication from a computer server in the 
Eastern District of Virginia to a representative of a 
copyright holder stating "1 file and 1 video removed 
from our system" in response to a takedown request 
that included a link to the 2010 version of the film "A 
Nightmare on Elm Street." 


Ten 


March 9, 2011 


A communication from a computer server in the 
Eastern District of Virginia to a representative of a 
copyright holder stating "2 files removed from our 
system" in response to a takedown request that 
included links to the 2009 version of the film "Friday 
the 13th" (in two parts). 


Eleven 


March 11, 2011 


A communication from a computer server in the 
Eastern District of Virginia to a representative of a 
copyright holder stating "2 files removed from our 
system" in response to a takedown request that 
included links to episodes of the television show 
"Modern Family." 


Twelve 


April 30, 2011 


A communication from a computer server in the 
Eastern District of Virginia to a representative of a 
copyright holder in response to a takedown request 
that included a link to the film "Fast Five." 


Thirteen 


August 10, 2011 


A communication from a computer server in the 
Eastern District of Virginia to a representative of a 
copyright holder stating "6 files and 6 videos removed 
from our system" in response to a takedown request 
that included links to the 2010 version of the film "A 
Nightmare on Elm Street." 
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NOTICE OF FORFEITURE 

(18 U.S.C. § 981(a)(1)(C); 18 U.S.C. § 982(a)(1); 
18 U.S.C. § 1963; 18 U.S.C. § 2323; 21 U.S.C. § 853; 28 U.S.C. § 2461(c)) 

106. The allegations contained in Counts One through Fourteen of this Indictment are 
hereby realleged and incorporated by reference for the purpose of alleging forfeiture. 

THE GRAND JURY HEREBY FINDS THAT: 

107. There is probable cause that the property described in this NOTICE OF 
FORFEITURE is subject to forfeiture pursuant to the statutes described herein. 

NOTICE AS TO COUNTS ONE THROUGH FOURTEEN AS TO ALL DEFENDANTS 

1 08. Pursuant to Federal Rule of Criminal Procedure 32.2(a), the United States of 
America gives notice to all defendants that, in the event of a conviction by any defendant of any 
of the offenses charged in Counts One through Fourteen of this Indictment, the United States 
intends to forfeit the property of that defendant as is further described in this NOTICE OF 
FORFEITURE. 

109. Pursuant to 18 U.S.C. § 1963, each defendant who is convicted of an offense in 
violation of 18 U.S.C. § 1962, shall forfeit to the United States of America: 

a. any interest that defendant has acquired or maintained in violation of 
Section 1962; 

b. any interest in, security of, claim against, or property or contractual right 
of any kind affording a source of influence over, any enterprise which the 
defendant, his co-conspirators, his associates, and other persons known or 
unknown to the grand jury have established, operated, controlled, 
conducted, or participated in the conduct of, in violation of Section 1962; 
and 

c. any property constituting, or derived from, any proceeds which the 
defendant obtained, directly or indirectly, from racketeering activity or 
unlawful debt collection in violation of 1962. 
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110. Pursuant to 18 U.S.C. § 981(a)(1)(C) and 28 U.S.C. § 2461(c), each defendant 
who is convicted of conspiracy to commit copyright infringement, in violation of 18 U.S.C. 
§§ 371 and 2319, shall forfeit to the United States of America any property, real or personal, 
which constitutes or is derived from proceeds traceable to the conspiracy. 

111. Pursuant to 1 8 U.S.C. § 982(a)(1), each defendant who is convicted of conspiracy 
to launder monetary instruments, in violation of 18 U.S.C. § 1956(h), shall forfeit to the United 
States of America any property, real or personal, involved in such offense, and any property 
traceable to such property. 

1 12. Pursuant to 18 U.S.C. § 2323, each defendant who is convicted of criminal 
copyright infringement, in violation of 18 U.S.C. § 2319 and 17 U.S.C. § 506, shall forfeit to the 
United States of America: 

a. any article, the making or trafficking of which is, prohibited under 
18 U.S.C. § 2319 or 17 U.S.C. § 506; 

b. any property used, or intended to be used, in any manner or part to commit 
or facilitate the commission of a violation of 1 8 U.S.C. § 23 1 9 or 1 7 
U.S.C. § 506; and 

c. any property constituting or derived from any proceeds obtained directly 
or indirectly as the result of the commission of a violation of 18 U.S.C. 
§2319 or 17 U.S.C. §506. 

1 13. Pursuant to 18 U.S.C. § 981(a)(1)(C) and 28 U.S.C. § 2461(c), each defendant 
who is convicted of wire fraud, in violation of 18 U.S.C. § 1343, shall forfeit to the United States 
of America any property, real or personal, which constitutes or is derived from proceeds 
traceable to the wire fraud scheme. 
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MONEY JUDGMENT 

1 14. The United States of America gives notice to all defendants, that upon conviction 
of any defendant, a money judgment may be imposed on that defendant equal to the total value 
of the property subject to forfeiture, which is at least $175,000,000. 



PROPERTY SUBJECT TO FORFEITURE 

115. The United States of America gives notice to all defendants, that the property to 
be forfeited includes, but is not limited to, the following: 

1. $175,000,000 in United States dollars; 

2. Bank of New Zealand, Account No. XX-XXXX-XXXX200-04, in the 
name of Cleaver Richards Trust Account for Megastuff Limited; 

3. Kiwibank, Account No. XX-XXXX-XXXX922-00, in the name of 
Megastuff Limited Nominee Account No. 1 ; 

4. Hongkong and Shanghai Banking Corporation Limited in Auckland, New 
Zealand, Account No. XXXXXXXXXXXX2088, in the name of BRAM 
VANDERKOLK; 

5. Citibank, Account No. XXXXXX3053, in the name of Megacard, Inc.; 

6. Citibank, Account No. XXXXXX3066, in the name of Megasite, Inc.; 

7. Stadtsparkasse Mtinchen, Account No. XXXX4734, in the name of 
FINN BATATO; 

8. Commerzbank, Account No. XXXXXXXX4800, in the name of 
SVEN ECHTERNACH; 

9. Deutsche Bank AG, Account No. XXXXXXXXXXXXXXXX6600, in the 
name of MATHIAS ORTMANN; 

1 0. Computershare Investor Services Limited, Holder No. XXXX4385, in the 
name of KIM DOTCOM (New Zealand Government Bonds); 

1 1 . Development Bank of Singapore, Account No. XXXXXX0320, in the 
name of MEGAUPLOAD LTD.; 

12. Development Bank of Singapore - Vickers Securities, Account No. 
XX1901, in the name of MEGAUPLOAD LTD.; 

13. Development Bank of Singapore- Vickers Securities, Account No. 
XXX089-4, in the name of Megamedia Ltd.; 
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14. Hang Seng Bank Ltd., Account No. XXXXXX78-833, in the name of 
Megamedia Ltd.; 

15. Hang Seng Bank, Account No. XXXXXXXX8001, in the name of 
Megamedia Ltd.; 

16. Hang Seng Bank, Account No. XXX-XXXX48-382, in the name of 
Megamedia Ltd.; 

1 7. Development Bank of Singapore, Account No. XXXXX5252, in the name 
of Megamusic Limited; 

1 8. Development Bank of Singapore, Account No. XXXXX0060, in the name 
of MEGAUPLOAD LTD.; 

19. Hang Seng Bank, Account No. XXX-XXXX75-883, in the name of 
MEGAUPLOAD LTD.; 

20. Westpac Bank, Account No. XX-XXXX-XXXX847-02, in the name of 
Simpson Grierson Trust Account, holder KIM DOTCOM. 

2 1 . Hongkong and Shanghai Banking Corporation Limited, Account Nos. 
XXX-XXXXX6-220/XXXX6-201/XXXXX6-838, in the name of 
MEGAUPLOAD LTD.; 

22. Hongkong and Shanghai Banking Corporation Limited, Account No. 
XXXXXXXX5 833, in the name of FINN BATATO; 

23. Hongkong and Shanghai Banking Corporation Limited, Account No. 
XXX-XXXXX5-833, in the name of an individual with the initials BVL; 

24. Hongkong and Shanghai Banking Corporation Limited, Account No. 
XXXXXXXX8833, in the name of ANDRUS NOMM; 

25. Hongkong and Shanghai Banking Corporation Limited, Account No. 
XXXXXXXX3833, in the name of BRAM VAN DER KOLK; 

26. Hang Seng Bank Ltd., Account No. XXX-XXXX52-888, in the name of 
KIM TIM JIM VESTOR; 

27. Hongkong and Shanghai Banking Corporation, Account 

No. XXXXXXXX7833, in the name of SVEN ECHTERNACH; 

28. Development Bank of Singapore, Account No. XXXXXX6 1 60, in the 
name of VESTOR LIMITED; 

29. Citibank (Hong Kong) Limited, Account No. XXXX892 1 , in the name of 
KIM TIM JIM VESTOR; 

30. Hongkong and Shanghai Banking Corporation Limited, Account 
No. XXXXXXXX4833, in the name of MATHIAS ORTMANN; 

3 1 . Hongkong and Shanghai Banking Corporation Limited, Account No. 
XXXXXXXX6888, in the name of an individual with the initials JPLL; 
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32. Hongkong and Shanghai Banking Corporation Limited, Account 
No. XXXXXXXX9833, in the name of JULIUS BENCKO; 

33. Hongkong and Shanghai Banking Corporation Limited, Account 
No. XXXXXXXX2838, in the name of RNK Media Company; 

34. Development Bank of Singapore Hong Kong, Account No. 
XXXXXX6930, in the name of A Limited; 

35. Development Bank of Singapore, Account No. XXXXX1690, in the name 
of A Limited; 

36. Citibank (Hong Kong) Limited, Account No. XXXX6237, in the name of 
KIM TIM JIM VESTOR; 

37. Development Bank of Singapore, Account No. XXXXXX9970, in the 
name of KIM DOTCOM/KIM VESTOR; 

38. Citibank (Hong Kong) Limited, Account No. XXXX8942, in the name of 
KIM TIM JIM VESTOR; 

39. Hongkong and Shanghai Banking Corporation Limited, Account 
No. XXX-XXXX1 6-888, in the name of KIM TIM JIM VESTOR; 

40. Industrial and Commercial Bank of China (Asia) Limited (ICBC), 
Account No. XXXXXXXX8434, in the name of MATHIAS ORTMANN; 

4 1 . Development Bank of Singapore, Account No. XXXXXX4440, in the 
name of Megapay Ltd. ; 

42. Development Bank of Singapore, Account No. XXX-XXX- 
XXXXXX8760, in the name of Megastuff Ltd.; 

43. Hongkong and Shanghai Banking Corporation Limited, Account 
No. XXXXXXXX6838, in the name of MEGAUPLOAD LTD.; 

44. Development Bank of Singapore, Account No. XXX-XXX- 
XXXXXX8870, in the name of N-l Limited; 

45. Development Bank of Singapore, Account No. XXX-XXX- 
XXXXXX1980, in the name of N-l Limited; 

46. Citibank (Hong Kong) Limited, Account No. XXXXX 0741 , in the name 
of KIM TIM JIM VESTOR; 

47. Citibank (Hong Kong) Limited, Account No. XXXXX0768, in the name 
of KIM TIM JIM VESTOR; 

48. Citibank (Hong Kong) Limited, Account No. XXXXX1 055, in the name 
of KIM TIM JIM VESTOR; 

49. Citibank (Hong Kong) Limited, Account No. XXXXX993 8, in the name 
of KIM TIM JDVI VESTOR; 
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50. Citibank (Hong Kong) Limited, Account No. XXXXX8948, in the name 
of KIM TIM JIM VESTOR; 

5 1 . Hongkong and Shanghai Banking Corporation, Account No. 
XXXXXXXX0833, in the name of an individual with the initials LRV; 

52. Hongkong and Shanghai Banking Corporation, Account No. XXX- 
XXXXX04-888, in the name of an individual with the initials WT; 

53 . Bank of the Philippine Islands, Account No. XXXXXX0069, in the name 
of Megateam Limited; 

54. Bank of the Philippine Islands, Account No. XXXXXX0264, in the name 
of Megateam Limited; 

55. Bank of the Philippine Islands, Account No. XXXXXX3627, in the name 
of KIM SCHMITZ; 

56. Bank of the Philippine Islands, Account No. XXXXXX7676, in the name 
of KIM SCHMITZ; 

57. Rabobank Nederland, Account No. NLXXXXXXXXXXXX73 00, in the 
name of Bramos BV; 

58. Hongkong and Shanghai Banking Corporation Australia, Account 
No. XXXXXXXX0087, in the name of MATHIAS ORTMANN; 

59. Ceskoslovenska Obchodna Banka Slovakia, Account No. 
XXXXXXXX9833, in the name of JULIUS BENCKO; 

60. Paypal Inc., account paypal@megaupload.com; 

6 1 . Paypal Inc., account belonging to KIM DOTCOM 
(xxxxxx@ultimaterally.com); 

62. Paypal Inc., accounts belonging to SVEN ECHTERNACH 
(xxxxxx@sectravel.com, xxxxxx@sectravel.com, and 
xxxxxx@sven.com); 

63. Paypal Inc., account belonging to BRAM VAN DER KOLK 
(xxxxxx@bramos.nl); 

64. Moneybookers Limited, account belonging to 
ccmerchant@megaupload.com; 

65. Moneybookers Limited, account belonging to 
moneybookers@megaupload.com; 

66. 2010 Maserati GranCabrio, VIN ZAMKM45B000051328, License Plate 
No. "M-FB 212" or "DH-GC 470", registered to FINN BATATO; 

67. 2009 Mercedes-Benz E500 Coupe, VIN WDD207372250 19582, License 
Plate No. "FEG690"; 
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68. 2005 Mercedes-Benz CLK DTM, VIN WDB2093422F165517, License 
Plate No. "GOOD"; 

69. 2004 Mercedes-Benz CLK DTM AMG 5.5L {Compressor, VIN 
WDB2093422F166073, License Plate No. "EVIL"; 

70. 2010 Mercedes-Benz S65 AMG L, VIN WDD221 1792A324354, License 
Plate No. "CEO"; 

71. 2008 Rolls-Royce Phantom Drop Head Coupe, VIN 
SCA2D68096UH07049; License Plate No. "GOD"; 

72. 2010 Mercedes-Benz E63 AMG, VIN WDD2120772A103834, License 
Plate No. "STONED"; 

73. 2010 Mini Cooper S Coupe, VIN WMWZG32000TZ03651, License Plate 
No. "V"; 

74. 2010 Mercedes-Benz ML63 AMG, VIN WDC1641772A608055, License 
Plate No. "GUILTY"; 

75. 2007 Mercedes-Benz CL65 AMG, VIN WDD2163792A025130, License 
Plate No. "KIMCOM"; 

76. 2009 Mercedes-Benz ML63 AMG, VIN WDC 1641 772 A542449, License 
Plate No. "MAFIA"; 

77. 2010 Toyota Vellfire, VIN 7AT0H65MX1 1041670, License Plate Nos. 
"WOW" or "7"; 

78. 201 1 Mercedes-Benz G55 AMG, VIN WDB4632702X1 93395, License 
Plate No "GDS672"; 

79. 201 1 Toyota Hilux, VIN MR0FZ29G00 1599926, License Plate 
No. "FSN455"; 

80. Harley Davidson Motorcycle, VIN 1HD1HPH3XBC803936, License 
Plate No. "36YED"; 

81. 2010 Mercedes-Benz CL63 AMG, VIN WDD2163742A026653, License 
Plate No. "HACKER"; 

82. 2005 Mercedes-Benz A170, VIN WDD1690322J1 84595, License Plate 
No. "FUR252"; 

83. 2005 Mercedes-Benz ML500, VIN WDC1641752A026107, License Plate 
N0.DFF8I6; 

84. Fiberglass sculpture, imported from the United Kingdom with Entry 
No. 83023712; 

85. 1957 Cadillac El Dorado, VIN 5770137596; 

86. 2010 Sea-Doo GTX Jet Ski, VIN YDV03103E010; 
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87. 1 959 Cadillac Series 62 Convertible, VIN 59F1 1 5669; 

88. Von Dutch Kustom Motor Bike, VIN 1H9S14955BB451257; 

89. 2006 Mercedes-Benz CLK DTM, VIN WDB2094421T067269; 

90. 2010 Mini Cooper S Coupe, VIN WMWZG32000TZ03648 License 
Plate No. "T"; 

91. 1989 Lamborghini LM002, VIN ZA9LU45 AXKL A 12158, License Plate 
No. "FRP358"; 

92. 201 1 Mercedes-Benz ML63, VIN 4JGBB7HB0BA666219; 

93. Samsung 820DXN 82" LCD TV; 

94. Samsung 820DXN 82" LCD TV; 

95. Samsung 820DXN 82" LCD TV; 

96. Devon Works LLC, Tread #1 time piece; 

97. Artwork, In High Spirits, Olaf Mueller photos from The Cat Street 
Gallery; 

98. Sharp 108" LCD Display TV; 

99. Sharp 1 08" LCD Display TV; 

100. Sony PMW-F3K Camera S/N 020023 1 ; 

101. Sony PMW-F3K Camera S/N 0200561; 

1 02. Artwork, Predator Statue; 

103. Artwork, Christian Colin; 

104. Artwork, Anonymous Hooded Sculpture; 

105. 2009 Mercedes-Benz ML350 CDI 4MATIC Off-Roader; 

106. Sharp LC-65XS1M 65" LCD TV; 

107. Sharp LC-65XS1M 65" LCD TV; 

108. TVLogic 56" LUM56W TV; 

109. Sixty (60) Dell R710 computer servers; 

1 10. The following domain names: Megastuff.co; Megaworld.com; 
Megaclicks.co; Megastuff.info; Megaclicks.org; Megaworld.mobi; 
Megastuff.org; Megaclick.us; Mageclick.com; HDmegaporn.com; 
Megavkdeo.com; Megaupload.com; Megaupload.org; Megarotic.com; 
Megaclick.com; Megavideo.com; Megavideoclips.com; Megaporn.com; 

111. HSBC Australia, Account No. XXXXXXXX0087, in the name of 
MATHIAS ORTMAN; 
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112. HSBC Australia, Account No. XXXXXXXX7 118, in the name of 
MATHIAS ORTMAN; 

113. The property at 5G The Prom, Coatesville, Auckland 0793, New Zealand, 
being all that parcel of land on Certificate of Title Number 341889, 
Auckland Registry; 

1 14. The property at 5H The Prom, Coatesville, Auckland 0793, New Zealand, 
being all that parcel of land on Certificate of Title Number 341890 on 
Deposited Plan 385357, Auckland Registry; 

1 15. Seadoo jet ski, serial number YDV00375L910; 

1 16. Seadoo jet ski, serial number YDV00385L910; 

1 17. Seadoo jet ski, serial number YDV03091E010; 

118. 201 1 Mercedes-Benz G55 AMG, VIN WDB4632702X191902, License 
. Plate No. "POLICE"; 

1 1 9. Diamond ring, with 1 8ct white gold band; 

120. Diamond-encrusted 18ct white gold crucifix, with stones; 

121 . Diamond-encrusted white gold bracelet, with blue and white stones; 

1 22. Louis Vuitton Tambour Bijou watch, white; 

1 23 . Louis Vuitton Tambour Bij ou watch, black; 

124. Diamond-encrusted sapphire ring; 

1 25 . Hublot King Power watch, serial number 848929 03/500; 

1 26. Hublot King Power watch, serial number 8 1 85 1 7 58/500; 

127. Breitling watch, yellow face, serial number FCCIDOPFE56X21 YE76321; 

128. Breitling watch, white face, serial number FCCIDOPFE56X21 YA73322; 

1 29. Bell & Ross BR0 1 -92S watch, blue face, serial number BLU-406/500; 

130. Bell & Ross BR01-92S watch, yellow face, serial number YLW-272/500; 

131. Rolex Oyster Perpetual watch, black face, with inscription: "Winner 
Rolex 24 AD Daytona 1 992"; 

132. Rolex Oyster Perpetual watch, white face, with inscription: "Winner 
Rolex 24 AD Daytona 1992"; and 

133. Chanel diamond-encrusted watch, black face, serial number SD54809. 



89 



Case 1 :1 2-cr-00003-LO Document 34 Filed 02/1 6/1 2 Page 90 of 90 PagelD# 335 



SUBSTITUTE ASSETS 

1 1 6. If any of the property described above, as a result of any act or omission of 
the defendants, 

a. cannot be located upon the exercise of due diligence; 

b. has been transferred or sold to, or deposited with, a third party; 

c. has been placed beyond the jurisdiction of the court; 

d. has been substantially diminished in value; or 

e. has been commingled with other property which cannot be divided 
without difficulty, 

the United States of America shall be entitled to and intends to seek forfeiture of substitute 
property pursuant to 18 U.S.C. § 1963(m) and 21 U.S.C. § 853(p), as incorporated by 18 U.S.C. 
§§ 982(b)(1) and 2323(b)(2), and 28 U.S.C. § 2461(c). 



(Pursuant to 18 U.S.C. §§ 981,982, 1963 & 2323; 21 U.S.C. § 853; 28 U.S.C. § 2461) 



NEIL H. MACBRIDE A TRUE BILL: 

UNITED STATES ATTORNEY 

Pursuant to the ^Government Act, 
the original of this page has been filed 
under seal in the Clerk's Office, 

JAY V. PRABHU Foreperson of the Grand Jury 

CHIEF, CYBERCRIME UNIT 

ASSISTANT UNITED STATES ATTORNEY 

RYAN K. DICKEY 

ASSISTANT UNITED STATES ATTORNEY 



LANNY A. BREUER 
ASSISTANT ATTORNEY GENERAL 
U.S. Department of Justice 
Criminal Division 

GLENN C. ALEXANDER 

TRIAL ATTORNEY 

U.S. Department of Justice 

Computer Crime & Intellectual Property Section 
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